DEBIAN-CVE-2020-37248
- Source
- https://security-tracker.debian.org/tracker/CVE-2020-37248
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-37248.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2020-37248
- Upstream
- Published
- 2026-06-08T16:16:33Z
- Modified
- 2026-09-11T11:02:47Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle attacks, taking over the connection and extracting account credentials in cleartext.
- References
Affected packages
Debian:12 / offlineimap3
Package
- Name
- offlineimap3
- Purl
- pkg:deb/debian/offlineimap3?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
0.*
0.0~git20211018.e64c254+dfsg-2
0.0~git20230519.c9f44ad+dfsg-1
0.0~git20231201.77e70ed+dfsg-1
0.0~git20231218.d29a4dc+dfsg-1
0.0~git20231218.d29a4dc+dfsg-2
0.0~git20231218.d29a4dc+dfsg-3
0.0~git20231218.d29a4dc+dfsg-4
0.0~git20240826.db34745+dfsg-1
0.0~git20240826.db34745+dfsg-2
8.*
8.0.2+dfsg-1
8.0.2+dfsg-2~exp1
8.0.3+dfsg-1
8.0.3+dfsg-2
Debian:13 / offlineimap3
Package
- Name
- offlineimap3
- Purl
- pkg:deb/debian/offlineimap3?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / offlineimap3
Package
- Name
- offlineimap3
- Purl
- pkg:deb/debian/offlineimap3?arch=source&distro=forky