A vulnerability was discovered in libetpan's STARTTLS handling, possibly allowing an integrity/confidentiality compromise.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-libs/libetpan | * | < 1.9.4-r1 | >= 1.9.4-r1 |
libetpan is a portable, efficient middleware for different kinds of mail access.
It was discovered that libetpan was not properly handling state within the STARTTLS protocol handshake.
There may be a breach of integrity or confidentiality in connections made using libetpan with STARTTLS.
There is no known workaround at this time.
All libetpan users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/libetpan-1.9.4-r1"