CVE-2020-14154

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-15 · updated 2026-06-17

Description

Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate certificate.

Affected products

Canonical Ubuntu Linux: 12.04, 16.04, 18.04, 19.10, 20.04
mutt: before 1.14.3 — fixed in 1.14.3

How to fix

Upgrade to a fixed version: mutt 1.14.3. Check the vendor advisory for mitigations.

References

http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20200608/000022.html
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00064.html
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00070.html
http://www.mutt.org
https://bugs.gentoo.org/728300
https://security.gentoo.org/glsa/202007-57
https://usn.ubuntu.com/4401-1/
http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20200608/000022.html
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00064.html
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00070.html
http://www.mutt.org
https://bugs.gentoo.org/728300

Get alerted when CVE-2020-14154 or the next vulnerability affects your stack