CVE catalog

CVE-2020-15953

libetpan: CVE-2020-15953

Severity: High · CVSS 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: Jul 27, 2020, 7:15:10 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.40% · Oct 25, 2026

LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libetpan	sid	`1.10.0-1.1`	fixed
Debian	libetpan	forky	`1.10.0-1.1`	fixed
Debian	libetpan	trixie	`1.9.4-6`	fixed
Debian	libetpan	bookworm	`1.9.4-3.1`	fixed
Ubuntu	libetpan	16.04	`1.5-2`	vulnerable
Ubuntu	libetpan	16.04	`1.6-1`	vulnerable
Ubuntu	libetpan	16.04	`1.6-1build1`	vulnerable
Ubuntu	libetpan	16.04	`1.6-1ubuntu0.1`	fixed
Opensuse	libetpan	leap 15.2	`1.9.4-lp152.3.3.1`	fixed
Suse	libetpan	package hub 15 sp2	`1.9.4-bp152.4.3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libetpan	source	sid	`1.9.4-3`	not yet assigned	Not reported	[966647]
Debian	libetpan	source	forky	`1.9.4-3`	not yet assigned	Not reported	[966647]
Debian	libetpan	source	trixie	`1.9.4-3`	not yet assigned	Not reported	[966647]
Debian	libetpan	source	bookworm	`1.9.4-3`	not yet assigned	Not reported	[966647]
Ubuntu	libetpan	deb	16.04	`1.6-1ubuntu0.1`	Not reported	USN-4598-1	Not reported
Opensuse	libetpan	rpm	leap 15.2	`1.9.4-lp152.3.3.1`	Not reported	OPENSUSE-SU-2020:1454-1	Not reported
Suse	libetpan	rpm	package hub 15 sp2	`1.9.4-bp152.4.3.1`	Not reported	OPENSUSE-SU-2020:1505-1	Not reported

[Debian bug #966647]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libetpan20]Fixed
Source package: [libetpan]
Details (2)
- 1.9.4-3.1 · amd64 · bookworm
  Fixed · Fixed: 1.9.4-3
  dsa · libetpan · debian · bookworm; dsa · libetpan · debian · 12
- 1.9.4-3.1 · arm64 · bookworm
  Fixed · Fixed: 1.9.4-3
  dsa · libetpan · debian · bookworm; dsa · libetpan · debian · 12
[libetpan-dev]Fixed
Source package: [libetpan]
Details (2)
- 1.9.4-3.1 · amd64 · bookworm
  Fixed · Fixed: 1.9.4-3
  dsa · libetpan · debian · bookworm; dsa · libetpan · debian · 12
- 1.9.4-3.1 · arm64 · bookworm
  Fixed · Fixed: 1.9.4-3
  dsa · libetpan · debian · bookworm; dsa · libetpan · debian · 12
[libetpan-doc]Fixed
Source package: [libetpan]
Details (2)
- 1.9.4-3.1 · all · bookworm
  Fixed · Fixed: 1.9.4-3
  dsa · libetpan · debian · bookworm; dsa · libetpan · debian · 12
- 1.9.4-3.1 · all · bookworm
  Fixed · Fixed: 1.9.4-3
  dsa · libetpan · debian · bookworm; dsa · libetpan · debian · 12

[Debian 13 (Trixie)]

[libetpan20t64]Fixed
Source package: [libetpan]
Details (2)
- 1.9.4-6 · amd64 · trixie
  Fixed · Fixed: 1.9.4-3
  dsa · libetpan · debian · 13
- 1.9.4-6 · arm64 · trixie
  Fixed · Fixed: 1.9.4-3
  dsa · libetpan · debian · 13
[libetpan-dev]Fixed
Source package: [libetpan]
Details (2)
- 1.9.4-6 · amd64 · trixie
  Fixed · Fixed: 1.9.4-3
  dsa · libetpan · debian · 13
- 1.9.4-6 · arm64 · trixie
  Fixed · Fixed: 1.9.4-3
  dsa · libetpan · debian · 13
[libetpan-doc]Fixed
Source package: [libetpan]
Details (2)
- 1.9.4-6 · all · trixie
  Fixed · Fixed: 1.9.4-3
  dsa · libetpan · debian · 13
- 1.9.4-6 · all · trixie
  Fixed · Fixed: 1.9.4-3
  dsa · libetpan · debian · 13

Observed: Oct 23, 2026, 5:48:31 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]