CVE-2021-38373

Name of the Vulnerable Software and Affected Versions KDE KMail version 19.12.3 (aka 5.13.3)

Description The SMTP STARTTLS option is not honored in KDE KMail, resulting in cleartext messages being sent unless the "Server requires authentication" option is checked.

Recommendations For KDE KMail version 19.12.3 (aka 5.13.3), ensure the "Server requires authentication" option is checked to enforce the use of STARTTLS for SMTP connections. As a temporary workaround, consider configuring the server to always require authentication for SMTP connections until a patch is available.