CVE-2020-14954

Name of the Vulnerable Software and Affected Versions: Mutt versions prior to 1.14.4 NeoMutt versions prior to 2020-06-19

Description: The issue is related to a STARTTLS buffering problem that affects IMAP, SMTP, and POP3 protocols. When a server sends a "begin TLS" response, the client reads additional data and evaluates it in a TLS context, which can lead to "response injection." This can potentially allow a remote attacker to gain unauthorized access to protected information.

Recommendations: For Mutt versions prior to 1.14.4, update to version 1.14.4 or later. For NeoMutt versions prior to 2020-06-19, update to a version released after 2020-06-19. As a temporary workaround, consider restricting the use of STARTTLS to minimize the risk of exploitation.