Bug 1111022 (CVE-2014-3494) - CVE-2014-3494 kdelibs: POP3 kioslave silently accepted invalid SSL certificates
Summary: CVE-2014-3494 kdelibs: POP3 kioslave silently accepted invalid SSL certificates
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-3494
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1111023
Blocks: 1111025
TreeView+ depends on / blocked
 
Reported: 2014-06-19 05:03 UTC by Murray McAllister
Modified: 2021-02-17 06:27 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-08-04 09:34:42 UTC
Embargoed:


Attachments (Terms of Use)

Description Murray McAllister 2014-06-19 05:03:25 UTC
The KDE project fixed the following issue:

""
Overview
========

The POP3 kioslave used by kmail will accept invalid certificates without
presenting a dialog to the user due a bug that leads to an inability to
display the dialog combined with an error in the way the result is checked.

Impact
======

This flaw allows an active attacker to perform MITM attacks against the
ioslave which could result in the leakage of sensitive data such as the
authentication details and the contents of emails.
""

Upstream notes this issue affected versions 4.10.95 to 4.13.2. It has been fixed in version 4.13.3. In addition to this, from an initial analysis it appears that only kdelibs in Fedora is affected (kdelibs3 should not be affected). kdelibs in Red Hat Enterprise Linux 5, 6, and 7 is older than the affected versions, and also appears to be missing the affected functionality.

Upstream advisory: http://www.kde.org/info/security/advisory-20140618-1.txt

Upstream commit: http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=bbae87dc1be3ae063796a582774bd5642cacdd5d&hp=1ccdb43ed3b32a7798eec6d39bb3c83a6e40228f

Comment 1 Murray McAllister 2014-06-19 05:04:30 UTC
Created kdelibs tracking bugs for this issue:

Affects: fedora-all [bug 1111023]

Comment 3 Fedora Update System 2014-07-01 07:23:28 UTC
kdelibs-4.12.5-4.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2014-07-06 00:55:10 UTC
kdelibs-4.11.5-4.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.