On Sat, Jun 20, 2020 at 11:12:07AM +0100, Stuart Henderson wrote: > On 2020/06/20 10:51, Matthieu Herrb wrote: > > On Thu, Jun 18, 2020 at 11:59:38PM -0600, Stuart Henderson wrote: > > > CVSROOT: /cvs > > > Module name: ports > > > Changes by: [email protected] 2020/06/18 23:59:38 > > > > > > Modified files: > > > mail/mutt : Makefile distinfo > > > > > > Log message: > > > update to mutt-1.14.4, fixes possible machine-in-the-middle response > > > injection attack when using STARTTLS with IMAP, POP3, and SMTP. > > > > > > Unfortunatly this breaks my configuration, that uses an ssh tunnels to > > connect to the imap server ie : > > > > account-hook imaps://imap.herrb.eu 'set tunnel="ssh -q imap.herrb.eu > > /usr/local/libexec/dovecot/imap"' > > > > mutt exits with 'Encrypted connection unavailable'. > > > > I've not seen any mention of 'set tunnel' beeing deprecated or broken > > in mutt's release notes. > > > > I guess it is bound to the MITM security issue. Wondering if this kind > > of setup is vulnerable, or if it's a false positive. > > > > I'm back to typing a password to read my mail for now... > > > > -- > > Matthieu Herrb > > > > https://gitlab.com/muttmua/mutt/-/issues/250
Thanks. The workaround works for me. -- Matthieu Herrb
