GNU bug report logs - #19283
25.0.50; imap.el with man-in-the-middle vulnerability

Previous Next

Package: emacs;

Reported by: Jens Lechtenboerger <jens.lechtenboerger <at> fsfe.org>

Date: Fri, 5 Dec 2014 19:39:02 UTC

Severity: normal

Tags: security

Found in version 25.0.50

Fixed in version 25.1

Done: Lars Ingebrigtsen <larsi <at> gnus.org>

Bug is archived. No further changes may be made.

Full log

Message #8 received at 19283 <at> debbugs.gnu.org (full text, mbox):

From: Andreas Schwab <schwab <at> linux-m68k.org>
To: Jens Lechtenboerger <jens.lechtenboerger <at> fsfe.org>
Cc: 19283 <at> debbugs.gnu.org
Subject: Re: bug#19283: 25.0.50; imap.el with man-in-the-middle vulnerability
Date: Fri, 05 Dec 2014 20:47:30 +0100

Jens Lechtenboerger <jens.lechtenboerger <at> fsfe.org> writes:

> In addition, imap.el only tries SSLv2 and SSLv3,

imap.el always tries STARTTLS and TLS before SSL, unless you force it to
do otherwise.

Andreas.

-- 
Andreas Schwab, schwab <at> linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."
This bug report was last modified 9 years and 154 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.