p PatchFirst

CVE-2024-49393

CVE-2024-49393 · Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

CVSS 6.5 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • mutt Debian:12

    Versions
    • 2.2.12-0.1
    • 2.2.12-0.1~deb12u1
    • 2.2.13-1
    • 2.2.9-1
    • 2.2.9-1+deb12u1
    • 2.3.2-1
    • 2.4.0-1
    • 2.4.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Debian:13

    Versions
    • 2.2.13-1
    • 2.2.13-1+deb13u1
    • 2.3.2-1
    • 2.4.0-1
    • 2.4.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Debian:14

    Versions
    • 2.2.13-1
    • 2.3.2-1
    • 2.4.0-1
    • 2.4.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Debian:12

    Versions
    • 20220429+dfsg1-4.1
    • 20231103+dfsg1-1
    • 20240425+dfsg-1
    • 20240425+dfsg-2
    • 20241002+dfsg-1
    • 20241002+dfsg-1~bpo12+1
    • 20241114+dfsg-1
    • 20241114+dfsg1-1
    • 20241212+dfsg-1
    • 20241212+dfsg-2
    • 20250109+dfsg-1
    • 20250113+dfsg-1
    • 20250113+dfsg-1~bpo12+1
    • 20250404+dfsg-1
    • 20250404+dfsg-1~bpo12+1
    • 20250404+dfsg-2
    • 20250404+dfsg-2~bpo12+1
    • 20250404+dfsg-2~bpo12+2
    • 20250510+dfsg-1
    • 20250510+dfsg-2
    • 20250510+dfsg-2~bpo12+1
    • 20250905+dfsg-1
    • 20251211+dfsg-1
    • 20260105+dfsg-1
    • 20260105+dfsg-1~bpo13+1
    • 20260406+dfsg-1
    • 20260504+dfsg-1
    • 20260616+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Debian:13

    Affected ranges
    • ECOSYSTEM: < 20241002+dfsg-1

    Update to 20241002+dfsg-1

  • neomutt Debian:14

    Affected ranges
    • ECOSYSTEM: < 20241002+dfsg-1

    Update to 20241002+dfsg-1

  • mutt Ubuntu:Pro:16.04:LTS

    Versions
    • 1.5.23-3.1ubuntu1
    • 1.5.23-3.1ubuntu2
    • 1.5.24-1
    • 1.5.24-1build1
    • 1.5.24-1ubuntu0.1
    • 1.5.24-1ubuntu0.2
    • 1.5.24-1ubuntu0.3
    • 1.5.24-1ubuntu0.4
    • 1.5.24-1ubuntu0.5
    • 1.5.24-1ubuntu0.6
    • 1.5.24-1ubuntu0.6+esm2
    • 1.5.24-1ubuntu0.6+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Ubuntu:Pro:18.04:LTS

    Versions
    • 1.8.3+neomutt20170609-2build1
    • 1.9.1-2
    • 1.9.1-3
    • 1.9.1-4
    • 1.9.1-5
    • 1.9.2-1
    • 1.9.3-1
    • 1.9.4-2
    • 1.9.4-3
    • 1.9.4-3ubuntu0.1
    • 1.9.4-3ubuntu0.2
    • 1.9.4-3ubuntu0.3
    • 1.9.4-3ubuntu0.4
    • 1.9.4-3ubuntu0.5
    • 1.9.4-3ubuntu0.6
    • 1.9.4-3ubuntu0.6+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Ubuntu:Pro:18.04:LTS

    Versions
    • 20171027-1
    • 20171027-2
    • 20171027+dfsg.1-1
    • 20171027+dfsg.1-2
    • 20171027+dfsg.1-4
    • 20171208+dfsg.1-1
    • 20171208+dfsg.1-2
    • 20171215+dfsg.1-1
    • 20171215+dfsg.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Ubuntu:20.04:LTS

    Versions
    • 1.10.1-2.1
    • 1.12.2-1
    • 1.12.2-2
    • 1.13.0-1
    • 1.13.2-1
    • 1.13.2-1ubuntu0.1
    • 1.13.2-1ubuntu0.2
    • 1.13.2-1ubuntu0.3
    • 1.13.2-1ubuntu0.4
    • 1.13.2-1ubuntu0.5
    • 1.13.2-1ubuntu0.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Ubuntu:Pro:20.04:LTS

    Versions
    • 20180716+dfsg.1-1.2
    • 20191111+dfsg.1-1
    • 20191207+dfsg.1-1.1
    Affected ranges
    • ECOSYSTEM: < 20191207+dfsg.1-1.1ubuntu0.1~esm1

    Update to 20191207+dfsg.1-1.1ubuntu0.1~esm1

  • mutt Ubuntu:22.04:LTS

    Versions
    • 2.0.5-4.1build1
    • 2.1.3-1
    • 2.1.4-1
    • 2.1.4-1build1
    • 2.1.4-1ubuntu1.1
    • 2.1.4-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Ubuntu:Pro:22.04:LTS

    Versions
    • 20201127+dfsg.1-1.2
    • 20211029+dfsg1-1
    Affected ranges
    • ECOSYSTEM: < 20211029+dfsg1-1ubuntu0.1~esm1

    Update to 20211029+dfsg1-1ubuntu0.1~esm1

  • mutt Ubuntu:24.04:LTS

    Versions
    • 2.2.9-1
    • 2.2.9-1ubuntu0.23.10.1
    • 2.2.12-0.1
    • 2.2.12-0.1build2
    • 2.2.12-0.1build3
    • 2.2.12-0.1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Ubuntu:Pro:24.04:LTS

    Versions
    • 20220429+dfsg1-4.1
    • 20231103+dfsg1-1
    • 20231103+dfsg1-1build2
    • 20231103+dfsg1-1build3
    Affected ranges
    • ECOSYSTEM: < 20231103+dfsg1-1ubuntu0.1~esm1

    Update to 20231103+dfsg1-1ubuntu0.1~esm1

  • mutt Ubuntu:25.10

    Versions
    • 2.2.13-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Ubuntu:26.10

    Versions
    • 2.2.13-1build2
    • 2.3.2-1
    • 2.4.0-1
    • 2.4.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Ubuntu:26.04:LTS

    Versions
    • 2.2.13-1
    • 2.2.13-1build1
    • 2.2.13-1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →