A vulnerability was discovered in libetpan's STARTTLS handling, possibly allowing an integrity/confidentiality compromise.
|Package||net-libs/libetpan on all architectures|
|Affected versions||< 1.9.4-r1|
|Unaffected versions||>= 1.9.4-r1|
libetpan is a portable, efficient middleware for different kinds of mail access.
It was discovered that libetpan was not properly handling state within the STARTTLS protocol handshake.
There may be a breach of integrity or confidentiality in connections made using libetpan with STARTTLS.
There is no known workaround at this time.
All libetpan users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/libetpan-1.9.4-r1"
July 28, 2020
July 28, 2020: 1