This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-38373 →

DEBIAN-CVE-2021-38373

In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" i...

Original description

The description as published by the source.

In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ksmtp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.12.3-2"}]}]

Debian:13 ksmtp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.12.3-2"}]}]

Debian:14 ksmtp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.12.3-2"}]}]

References

advisory security-tracker.debian.org