CVE-2020-15917: claws-mail claws-mail – CVSS 9.8 · Watchpost

← All vulnerabilities

CVE-2020-15917

CRITICAL 9.8CVE-2020-15917 · Published 23/07/2020 · updated 17/06/2026

In short

CVE-2020-15917 is a CRITICAL (CVSS 9.8) vulnerability affecting claws-mail (claws-mail), backports sle (opensuse).
Chance of exploitation in the next 30 days (EPSS): 2.6%, higher than 85.4% of all vulnerabilities.
Fix: update to 3.17.6 or later.

Package	Affected versions	Patched versions
claws-mail claws-mail	`< 3.17.6`	`3.17.6`
backports sle opensuse	`= 15.0`	No fix yet

Description

common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.

References

lists.opensuse.org/opensuse-security-announce/2020-07/msg00090.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-08/msg00002.html · Broken Link
lists.opensuse.org/opensuse-security-announce/2020-08/msg00060.html · Broken Link
lists.opensuse.org/opensuse-security-announce/2020-09/msg00051.html · Broken Link
lists.opensuse.org/opensuse-security-announce/2020-11/msg00013.html · Broken Link
git.claws-mail.org
git.claws-mail.org
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YVQB7NRBHO67Q74RS7RZCMW4ENRVBB4
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G7UX65342HRVDQML4G4GEVEUB764EUM5

More vulnerabilities in claws-mail

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free