CVE-2020-15953: Injection Vulnerability

July 27, 2020 (updated July 30, 2020)

LibEtPan has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a begin TLS response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka response injection.

References

nvd.nist.gov/vuln/detail/CVE-2020-15953

Code Behaviors & Features

Detect and mitigate CVE-2020-15953 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →