Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : https://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can make the creation of a TLS tunnel by the smtplib
module of Python, in order to read sent mails.

– Impacted products: Debian, Fedora, Python.
– Severity: 1/4.
– Creation date: 16/06/2016.

DESCRIPTION OF THE VULNERABILITY

The Python library includes a SMTP client.

This library enables a TLS tunnel. However, it does not check the
status code of the STARTTLS command and accept to continue the
SMTP session in plain text. An attacker who can hijack the traffic
can insert an error after the STARTTLS command to disable the
encryption.

An attacker can therefore make the creation of a TLS tunnel by the
smtplib module of Python, in order to read sent mails.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

https://vigilance.fr/vulnerability/Python-TLS-disabling-in-smtplib-19915