getmail: Information disclosure — GLSA 201412-50

Multiple vulnerabilities have been discovered in getmail, allowing remote attackers to obtain sensitive information.

Affected packages

net-mail/getmail on all architectures
Affected versions < 4.46.0
Unaffected versions >= 4.46.0

Background

getmail is a POP3 mail retriever with reliable Maildir and mbox delivery.

Description

Multiple vulnerabilities have been discovered in getmail. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could cause a man-in-the-middle attack via multiple vectors to obtain sensitive information.

Workaround

There is no known workaround at this time.

Resolution

All getmail users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-mail/getmail-4.46.0"
 

References

Release date
December 28, 2014

Latest revision
December 28, 2014: 1

Severity
normal

Exploitable
remote

Bugzilla entries