Описание
Security update for alpine
This update for alpine fixes the following issues:
Update to release 2.24
- A few crash fixes
- Implementation of XOAUTH2 for Yahoo! Mail.
Update to release 2.23.2
- Expansion of the configuration screen for XOAUTH2 to include username, and tenant.
- Alpine uses the domain in the From: header of a message to generate a message-id and suppresses all information about Alpine, version, revision, and time of generation of the message-id from this header.
- Alpine does not generate Sender or X-X-Sender by default by enabling [X] Disable Sender as the default.
- Alpine does not disclose User Agent by default by enabling [X] Suppress User Agent by default.
- When messages are selected, pressing the ';' command to broaden or narrow a search, now offers the possibility to completely replace the search, and is almost equivalent to being a shortcut to 'unselect all messages, and select again'.
Update to release 2.23
- Fixes boo#1173281, CVE-2020-14929: Alpine silently proceeds to use an insecure connection after a /tls is sent in certain circumstances.
- Implementation of XOAUTH2 authentication support for Outlook.
- Add support for the OAUTHBEARER authentication method in Gmail.
- Support for the SASL-IR IMAP extension.
- Alpine can pass an HTML message to an external web browser, by using the 'External' command in the ATTACHMENT INDEX screen.
Update to release 2.22
- Support for XOAUTH2 authentication method in Gmail.
- NTLM authentication support with the ntlm library.
- Added the '/tls1_3' flag for servers that support it.
- Add the 'g' option to the select command that works in IMAP servers that implement the X-GM-EXT-1 capability (such as the one offered by Gmail).
- Added '/auth=XYZ' to the way to define a server. This allows users to select the method to authenticate to an IMAP, SMTP or POP3 server. Examples are /auth=plain, or /auth=gssapi, etc.
- When a message is of type multipart/mixed, and its first part is multipart/signed, Alpine will include the text of the original message in a reply message, instead of including a multipart attachment.
- Added backward search in the index screen.
- pico: Add -dict option to Pico, which allows users to choose a dictionary when spelling.
- Drop /usr/bin/mailutil, it is not built by default anymore.
- Added Quota subcommands for printing, forwarding, saving, etc.
Список пакетов
openSUSE Leap 15.2
alpine-2.24-lp152.5.3.1
pico-5.07-lp152.5.3.1
pilot-2.99-lp152.5.3.1
Ссылки
- E-Mail link for openSUSE-SU-2021:0675-1
- SUSE Security Ratings
- SUSE Bug 1173281
- SUSE CVE CVE-2020-14929 page
Описание
Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.
Затронутые продукты
openSUSE Leap 15.2:alpine-2.24-lp152.5.3.1
openSUSE Leap 15.2:pico-5.07-lp152.5.3.1
openSUSE Leap 15.2:pilot-2.99-lp152.5.3.1
Ссылки
- CVE-2020-14929
- SUSE Bug 1173281