Log in Start free

Vulnerability · Published Nov 12, 2024 · Assigned by redhat

CVE-2024-49395Mutt: neomutt: bcc email header field is indirectly leaked by cryptographic info block

Medium 5.3

In plain English

A medium-severity security flaw in mutt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 76.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12muttno fix listedDEBIAN-CVE-2024-49395
Debian:13muttno fix listedDEBIAN-CVE-2024-49395
Debian:14muttno fix listedDEBIAN-CVE-2024-49395
Debian:12neomuttno fix listedDEBIAN-CVE-2024-49395
Debian:13neomuttno fix listedDEBIAN-CVE-2024-49395
Debian:14neomuttno fix listedDEBIAN-CVE-2024-49395
Ubuntu:22.04:LTSmuttno fix listedUBUNTU-CVE-2024-49395
Ubuntu:24.04:LTSmuttno fix listedUBUNTU-CVE-2024-49395
Ubuntu:25.10muttno fix listedUBUNTU-CVE-2024-49395
Ubuntu:26.04:LTSmuttno fix listedUBUNTU-CVE-2024-49395
Ubuntu:26.10muttno fix listedUBUNTU-CVE-2024-49395
Ubuntu:25.10neomuttno fix listedUBUNTU-CVE-2024-49395
Ubuntu:26.04:LTSneomuttno fix listedUBUNTU-CVE-2024-49395
Ubuntu:26.10neomuttno fix listedUBUNTU-CVE-2024-49395

Affected products (as reported)

VendorProductVersions
mutt see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-1230 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References