CVE-2020-15917

Vulnerability

Claws Mail versions before 3.17.6 contain a protocol violation in the function common/session.c, which mishandles suffix data that may appear after a STARTTLS command during the SMTP or IMAP connection handshake [1][2][3]. This flaw occurs because the client does not properly clear or ignore any residual data received after initiating the TLS upgrade, contrary to the TLS protocol specification.

Exploitation

An attacker who can perform a man-in-the-middle (MITM) attack on the network path between the Claws Mail client and the mail server could inject crafted suffix data after the STARTTLS response [3]. The attacker does not require authentication or prior access to the mail client. The exploitation does not rely on user interaction beyond the client being configured to use STARTTLS (opportunistic or mandatory).

Impact

Successful exploitation could allow the attacker to breach the integrity or confidentiality of email connections that use STARTTLS [3]. The protocol violation may lead to downgrade attacks, disclosure of credentials or message content, or injection of malicious data into the TLS session, depending on the attacker’s goals and the mail server’s behavior.

Mitigation

Users should upgrade to Claws Mail version 3.17.6 or later, which fixes the protocol handling [1][2][3]. For Gentoo Linux users, the patched version is available via >=mail-client/claws-mail-3.17.6 [3]. No workaround is known; applying the update is the only advised mitigation.