CVE catalog

CVE-2020-14093

mutt: CVE-2020-14093

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.14% · Oct 25, 2026

Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmuttsid2.4.1-1.1fixed
Debianmuttforky2.4.1-1fixed
Debianmutttrixie2.2.13-1+deb13u1fixed
Debianmutttrixie-security2.2.13-1+deb13u2fixed
Debianmuttbookworm2.2.12-0.1~deb12u1fixed
Debianmuttbookworm-security2.2.9-1+deb12u1fixed
Debianneomuttsid20260616+dfsg-1fixed
Debianneomuttforky20260616+dfsg-1fixed
Debianneomutttrixie20250510+dfsg-2fixed
Debianneomuttbookworm20220429+dfsg1-4.1fixed
Ubuntumutt16.041.5.23-3.1ubuntu1vulnerable
Ubuntumutt16.041.5.23-3.1ubuntu2vulnerable
Ubuntumutt16.041.5.24-1vulnerable
Ubuntumutt16.041.5.24-1build1vulnerable
Ubuntumutt16.041.5.24-1ubuntu0.1vulnerable
Ubuntumutt16.041.5.24-1ubuntu0.2vulnerable
Ubuntumutt16.041.5.24-1ubuntu0.3fixed
Ubuntumutt18.041.8.3+neomutt20170609-2build1vulnerable
Ubuntumutt18.041.9.1-2vulnerable
Ubuntumutt18.041.9.1-3vulnerable
Ubuntumutt18.041.9.1-4vulnerable
Ubuntumutt18.041.9.1-5vulnerable
Ubuntumutt18.041.9.2-1vulnerable
Ubuntumutt18.041.9.3-1vulnerable
Ubuntumutt18.041.9.4-2vulnerable
Ubuntumutt18.041.9.4-3vulnerable
Ubuntumutt18.041.9.4-3ubuntu0.1vulnerable
Ubuntumutt18.041.9.4-3ubuntu0.2fixed
Ubuntumutt20.041.10.1-2.1vulnerable
Ubuntumutt20.041.12.2-1vulnerable
Ubuntumutt20.041.12.2-2vulnerable
Ubuntumutt20.041.13.0-1vulnerable
Ubuntumutt20.041.13.2-1vulnerable
Ubuntumutt20.041.13.2-1ubuntu0.1fixed
Suseneomuttpackage hub 15 sp220201120-bp152.2.3.1fixed
Susemutthpe helion openstack 81.10.1-55.11.1fixed
Susemuttopenstack cloud 71.10.1-55.11.1fixed
Susemuttopenstack cloud 81.10.1-55.11.1fixed
Susemuttopenstack cloud crowbar 81.10.1-55.11.1fixed
Susemuttlinux enterprise server for sap applications 12 sp21.10.1-55.11.1fixed
Susemuttlinux enterprise server for sap applications 12 sp31.10.1-55.11.1fixed
Susemuttlinux enterprise server 12 sp2-ltss1.10.1-55.11.1fixed
Susemuttlinux enterprise server 12 sp2-bcl1.10.1-55.11.1fixed
Susemuttlinux enterprise server 12 sp3-ltss1.10.1-55.11.1fixed
Susemuttlinux enterprise server 12 sp3-bcl1.10.1-55.11.1fixed
Susemuttlinux enterprise server 12 sp41.10.1-55.11.1fixed
Susemuttlinux enterprise server for sap applications 12 sp41.10.1-55.11.1fixed
Susemuttlinux enterprise server 12 sp51.10.1-55.11.1fixed
Susemuttlinux enterprise server for sap applications 12 sp51.10.1-55.11.1fixed
Susemuttenterprise storage 51.10.1-55.11.1fixed
Susemuttlinux enterprise point of sale 11 sp31.5.17-42.51.1fixed
Susemuttlinux enterprise server 11 sp4-ltss1.5.17-42.51.1fixed
Susemuttlinux enterprise module for basesystem 15 sp11.10.1-3.8.1fixed
Susemuttlinux enterprise module for basesystem 15 sp21.10.1-3.8.1fixed
Susemuttlinux enterprise high performance computing 15-espos1.10.1-3.8.1fixed
Susemuttlinux enterprise high performance computing 15-ltss1.10.1-3.8.1fixed
Susemuttlinux enterprise server 15-ltss1.10.1-3.8.1fixed
Susemuttlinux enterprise server for sap applications 151.10.1-3.8.1fixed
Suseneomuttpackage hub 15 sp120201120-bp151.3.3.1fixed
Opensusemuttleap 15.11.10.1-lp151.2.3.1fixed
Opensuseneomuttleap 15.120201120-lp152.2.3.1fixed
Opensuseneomuttleap 15.220201120-lp152.2.3.1fixed
Ubuntumutt16.041.5.23-3.1ubuntu1vulnerable
Ubuntumutt16.041.5.23-3.1ubuntu2vulnerable
Ubuntumutt16.041.5.24-1vulnerable
Ubuntumutt16.041.5.24-1build1vulnerable
Ubuntumutt16.041.5.24-1ubuntu0.1vulnerable
Ubuntumutt16.041.5.24-1ubuntu0.2vulnerable
Ubuntumutt16.041.5.24-1ubuntu0.3fixed
Ubuntumutt18.041.8.3+neomutt20170609-2build1vulnerable
Ubuntumutt18.041.9.1-2vulnerable
Ubuntumutt18.041.9.1-3vulnerable
Ubuntumutt18.041.9.1-4vulnerable
Ubuntumutt18.041.9.1-5vulnerable
Ubuntumutt18.041.9.2-1vulnerable
Ubuntumutt18.041.9.3-1vulnerable
Ubuntumutt18.041.9.4-2vulnerable
Ubuntumutt18.041.9.4-3vulnerable
Ubuntumutt18.041.9.4-3ubuntu0.1vulnerable
Ubuntumutt18.041.9.4-3ubuntu0.2fixed
Ubuntumutt20.041.10.1-2.1vulnerable
Ubuntumutt20.041.12.2-1vulnerable
Ubuntumutt20.041.12.2-2vulnerable
Ubuntumutt20.041.13.0-1vulnerable
Ubuntumutt20.041.13.2-1vulnerable
Ubuntumutt20.041.13.2-1ubuntu0.1fixed
Opensusemuttleap 15.21.10.1-lp152.3.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmuttsourcesid1.14.3-1not yet assignedNot reported[962897]
Debianmuttsourceforky1.14.3-1not yet assignedNot reported[962897]
Debianmuttsourcetrixie1.14.3-1not yet assignedNot reported[962897]
Debianmuttsourcebookworm1.14.3-1not yet assignedNot reported[962897]
Debianneomuttsourcesid20200619+dfsg.1-1not yet assignedNot reportedNot reported
Debianneomuttsourceforky20200619+dfsg.1-1not yet assignedNot reportedNot reported
Debianneomuttsourcetrixie20200619+dfsg.1-1not yet assignedNot reportedNot reported
Debianneomuttsourcebookworm20200619+dfsg.1-1not yet assignedNot reportedNot reported
Ubuntumuttdeb16.041.5.24-1ubuntu0.3Not reportedUSN-4401-1Not reported
Ubuntumuttdeb18.041.9.4-3ubuntu0.2Not reportedUSN-4401-1Not reported
Ubuntumuttdeb20.041.13.2-1ubuntu0.1Not reportedUSN-4401-1Not reported
Suseneomuttrpmpackage hub 15 sp220201120-bp152.2.3.1Not reportedOPENSUSE-SU-2020:2158-1Not reported
Susemuttrpmhpe helion openstack 81.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmopenstack cloud 71.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmopenstack cloud 81.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmopenstack cloud crowbar 81.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmlinux enterprise server for sap applications 12 sp21.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmlinux enterprise server for sap applications 12 sp31.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmlinux enterprise server 12 sp2-ltss1.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmlinux enterprise server 12 sp2-bcl1.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmlinux enterprise server 12 sp3-ltss1.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmlinux enterprise server 12 sp3-bcl1.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmlinux enterprise server 12 sp41.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmlinux enterprise server for sap applications 12 sp41.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmlinux enterprise server 12 sp51.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmlinux enterprise server for sap applications 12 sp51.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmenterprise storage 51.10.1-55.11.1Not reportedSUSE-SU-2020:1794-1Not reported
Susemuttrpmlinux enterprise point of sale 11 sp31.5.17-42.51.1Not reportedSUSE-SU-2020:14414-1Not reported
Susemuttrpmlinux enterprise server 11 sp4-ltss1.5.17-42.51.1Not reportedSUSE-SU-2020:14414-1Not reported
Susemuttrpmlinux enterprise module for basesystem 15 sp11.10.1-3.8.1Not reportedSUSE-SU-2020:1771-1Not reported
Susemuttrpmlinux enterprise module for basesystem 15 sp21.10.1-3.8.1Not reportedSUSE-SU-2020:1771-1Not reported
Susemuttrpmlinux enterprise high performance computing 15-espos1.10.1-3.8.1Not reportedSUSE-SU-2020:1771-1Not reported
Susemuttrpmlinux enterprise high performance computing 15-ltss1.10.1-3.8.1Not reportedSUSE-SU-2020:1771-1Not reported
Susemuttrpmlinux enterprise server 15-ltss1.10.1-3.8.1Not reportedSUSE-SU-2020:1771-1Not reported
Susemuttrpmlinux enterprise server for sap applications 151.10.1-3.8.1Not reportedSUSE-SU-2020:1771-1Not reported
Suseneomuttrpmpackage hub 15 sp120201120-bp151.3.3.1Not reportedOPENSUSE-SU-2020:2157-1Not reported
Opensusemuttrpmleap 15.11.10.1-lp151.2.3.1Not reportedOPENSUSE-SU-2020:0903-1Not reported
Opensuseneomuttrpmleap 15.120201120-lp152.2.3.1Not reportedOPENSUSE-SU-2020:2127-1Not reported
Opensuseneomuttrpmleap 15.220201120-lp152.2.3.1Not reportedOPENSUSE-SU-2020:2127-1Not reported
Ubuntumuttdeb16.041.5.24-1ubuntu0.3Not reportedUBUNTU-CVE-2020-14093Not reported
Ubuntumuttdeb18.041.9.4-3ubuntu0.2Not reportedUBUNTU-CVE-2020-14093Not reported
Ubuntumuttdeb20.041.13.2-1ubuntu0.1Not reportedUBUNTU-CVE-2020-14093Not reported
Opensusemuttrpmleap 15.21.10.1-lp152.3.3.1Not reportedOPENSUSE-SU-2020:0915-1Not reported

[Debian bug #962897]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [mutt]Unknown
    Details (4)

    • 2.2.12-0.1~deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.14.3-1

      dsa · mutt · debian · bookworm; dsa · mutt · debian · 12

    • 2.2.12-0.1~deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.14.3-1

      dsa · mutt · debian · bookworm; dsa · mutt · debian · 12

    • 2.2.9-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.14.3-1

      dsa · mutt · debian · bookworm; dsa · mutt · debian · 12

    • 2.2.9-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.14.3-1

      dsa · mutt · debian · bookworm; dsa · mutt · debian · 12

  • [neomutt]Unknown
    Details (4)

    • 20220429+dfsg1-4.1 · amd64 · bookworm

      Fixed · Fixed: 20200619+dfsg.1-1

      dsa · neomutt · debian · bookworm; dsa · neomutt · debian · 12

    • 20220429+dfsg1-4.1 · arm64 · bookworm

      Fixed · Fixed: 20200619+dfsg.1-1

      dsa · neomutt · debian · bookworm; dsa · neomutt · debian · 12

    • 20250510+dfsg-2~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 20200619+dfsg.1-1

      dsa · neomutt · debian · bookworm; dsa · neomutt · debian · 12

    • 20250510+dfsg-2~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 20200619+dfsg.1-1

      dsa · neomutt · debian · bookworm; dsa · neomutt · debian · 12

[Debian 13 (Trixie)]

  • [mutt]Unknown
    Details (3)

    • 2.2.13-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.14.3-1

      dsa · mutt · debian · 13

    • 2.2.13-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.14.3-1

      dsa · mutt · debian · 13

    • 2.2.13-1+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 1.14.3-1

      dsa · mutt · debian · 13

  • [neomutt]Unknown
    Details (4)

    • 20250510+dfsg-2 · amd64 · trixie

      Fixed · Fixed: 20200619+dfsg.1-1

      dsa · neomutt · debian · 13

    • 20250510+dfsg-2 · arm64 · trixie

      Fixed · Fixed: 20200619+dfsg.1-1

      dsa · neomutt · debian · 13

    • 20260105+dfsg-1~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 20200619+dfsg.1-1

      dsa · neomutt · debian · 13

    • 20260105+dfsg-1~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 20200619+dfsg.1-1

      dsa · neomutt · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]