msmtp: X.509 NULL spoofing vulnerability

msmtp: X.509 NULL spoofing vulnerability An error in the hostname matching in msmtp might enable remote attackers to conduct man-in-the-middle attacks. msmtp 2012-06-25 2012-06-25 293647 remote 1.4.19 1.4.19

msmtp is an SMTP client and SMTP plugin for mail user agents such as Mutt.

A vulnerability have been discovered in msmtp. Please review the CVE identifier referenced below for details.

A remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on SSL connections made using msmtp.

There is no known workaround at this time.

All msmtp users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=mail-mta/msmtp-1.4.19"

CVE-2009-3942 craig craig