p PatchFirst

CVE-2024-49395

CVE-2024-49395 · Mutt: neomutt: bcc email header field is indirectly leaked by cryptographic info block

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.

CVSS 5.3 · Medium · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • mutt Debian:12

    Versions
    • 2.2.12-0.1
    • 2.2.12-0.1~deb12u1
    • 2.2.13-1
    • 2.2.9-1
    • 2.2.9-1+deb12u1
    • 2.3.2-1
    • 2.4.0-1
    • 2.4.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Debian:13

    Versions
    • 2.2.13-1
    • 2.2.13-1+deb13u1
    • 2.3.2-1
    • 2.4.0-1
    • 2.4.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Debian:14

    Versions
    • 2.2.13-1
    • 2.3.2-1
    • 2.4.0-1
    • 2.4.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Debian:12

    Versions
    • 20220429+dfsg1-4.1
    • 20231103+dfsg1-1
    • 20240425+dfsg-1
    • 20240425+dfsg-2
    • 20241002+dfsg-1
    • 20241002+dfsg-1~bpo12+1
    • 20241114+dfsg-1
    • 20241114+dfsg1-1
    • 20241212+dfsg-1
    • 20241212+dfsg-2
    • 20250109+dfsg-1
    • 20250113+dfsg-1
    • 20250113+dfsg-1~bpo12+1
    • 20250404+dfsg-1
    • 20250404+dfsg-1~bpo12+1
    • 20250404+dfsg-2
    • 20250404+dfsg-2~bpo12+1
    • 20250404+dfsg-2~bpo12+2
    • 20250510+dfsg-1
    • 20250510+dfsg-2
    • 20250510+dfsg-2~bpo12+1
    • 20250905+dfsg-1
    • 20251211+dfsg-1
    • 20260105+dfsg-1
    • 20260105+dfsg-1~bpo13+1
    • 20260406+dfsg-1
    • 20260504+dfsg-1
    • 20260616+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Debian:13

    Versions
    • 20250510+dfsg-2
    • 20250905+dfsg-1
    • 20251211+dfsg-1
    • 20260105+dfsg-1
    • 20260105+dfsg-1~bpo13+1
    • 20260406+dfsg-1
    • 20260504+dfsg-1
    • 20260616+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Debian:14

    Versions
    • 20250510+dfsg-2
    • 20250905+dfsg-1
    • 20251211+dfsg-1
    • 20260105+dfsg-1
    • 20260105+dfsg-1~bpo13+1
    • 20260406+dfsg-1
    • 20260504+dfsg-1
    • 20260616+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Ubuntu:Pro:16.04:LTS

    Versions
    • 1.5.23-3.1ubuntu1
    • 1.5.23-3.1ubuntu2
    • 1.5.24-1
    • 1.5.24-1build1
    • 1.5.24-1ubuntu0.1
    • 1.5.24-1ubuntu0.2
    • 1.5.24-1ubuntu0.3
    • 1.5.24-1ubuntu0.4
    • 1.5.24-1ubuntu0.5
    • 1.5.24-1ubuntu0.6
    • 1.5.24-1ubuntu0.6+esm2
    • 1.5.24-1ubuntu0.6+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Ubuntu:Pro:18.04:LTS

    Versions
    • 1.8.3+neomutt20170609-2build1
    • 1.9.1-2
    • 1.9.1-3
    • 1.9.1-4
    • 1.9.1-5
    • 1.9.2-1
    • 1.9.3-1
    • 1.9.4-2
    • 1.9.4-3
    • 1.9.4-3ubuntu0.1
    • 1.9.4-3ubuntu0.2
    • 1.9.4-3ubuntu0.3
    • 1.9.4-3ubuntu0.4
    • 1.9.4-3ubuntu0.5
    • 1.9.4-3ubuntu0.6
    • 1.9.4-3ubuntu0.6+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Ubuntu:Pro:18.04:LTS

    Versions
    • 20171027-1
    • 20171027-2
    • 20171027+dfsg.1-1
    • 20171027+dfsg.1-2
    • 20171027+dfsg.1-4
    • 20171208+dfsg.1-1
    • 20171208+dfsg.1-2
    • 20171215+dfsg.1-1
    • 20171215+dfsg.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Ubuntu:20.04:LTS

    Versions
    • 1.10.1-2.1
    • 1.12.2-1
    • 1.12.2-2
    • 1.13.0-1
    • 1.13.2-1
    • 1.13.2-1ubuntu0.1
    • 1.13.2-1ubuntu0.2
    • 1.13.2-1ubuntu0.3
    • 1.13.2-1ubuntu0.4
    • 1.13.2-1ubuntu0.5
    • 1.13.2-1ubuntu0.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Ubuntu:Pro:20.04:LTS

    Versions
    • 20180716+dfsg.1-1.2
    • 20191111+dfsg.1-1
    • 20191207+dfsg.1-1.1
    • 20191207+dfsg.1-1.1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Ubuntu:22.04:LTS

    Versions
    • 2.0.5-4.1build1
    • 2.1.3-1
    • 2.1.4-1
    • 2.1.4-1build1
    • 2.1.4-1ubuntu1.1
    • 2.1.4-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Ubuntu:Pro:22.04:LTS

    Versions
    • 20201127+dfsg.1-1.2
    • 20211029+dfsg1-1
    • 20211029+dfsg1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Ubuntu:24.04:LTS

    Versions
    • 2.2.9-1
    • 2.2.9-1ubuntu0.23.10.1
    • 2.2.12-0.1
    • 2.2.12-0.1build2
    • 2.2.12-0.1build3
    • 2.2.12-0.1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Ubuntu:Pro:24.04:LTS

    Versions
    • 20220429+dfsg1-4.1
    • 20231103+dfsg1-1
    • 20231103+dfsg1-1build2
    • 20231103+dfsg1-1build3
    • 20231103+dfsg1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Ubuntu:25.10

    Versions
    • 2.2.13-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Ubuntu:25.10

    Versions
    • 20250113+dfsg-1
    • 20250404+dfsg-2
    • 20250510+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Ubuntu:26.10

    Versions
    • 2.2.13-1build2
    • 2.3.2-1
    • 2.4.0-1
    • 2.4.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neomutt Ubuntu:26.10

    Versions
    • 20260105+dfsg-1build1
    • 20260504+dfsg-1
    • 20260616+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mutt Ubuntu:26.04:LTS

    Versions
    • 2.2.13-1
    • 2.2.13-1build1
    • 2.2.13-1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →