CVE-2020-15047: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2020-15047 is a security vulnerability discovered in Trojita email client versions before 0.8. The vulnerability was disclosed on June 25, 2020, and affects the MSA/SMTP.cpp component of the software. The core issue lies in the application's handling of certificate verification errors during SMTP connections (NVD, CVE).

The vulnerability stems from the MSA/SMTP.cpp component ignoring certificate-verification errors during SMTP connections. This implementation flaw has been present since May 2009, when the initial SMTP support was added to the codebase. The vulnerability is classified as CWE-295 (Improper Certificate Validation) with a CVSS v3.1 base score of 5.9 (Medium), and vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (KDE Bug).

The vulnerability allows man-in-the-middle attackers to spoof SMTP servers. When exploited, attackers could potentially intercept sensitive information including user authentication details, passwords, and the content of sent messages. The security implications are particularly severe as the application silently proceeds with connections even when presented with invalid certificates (KDE Bug).

The vulnerability requires a man-in-the-middle position to exploit, allowing attackers to intercept SMTP connections. The attack can be executed by presenting invalid or self-signed certificates to the client, which would proceed with the connection without warning the user (KDE Bug).

The vulnerability was patched in Trojita commit 77ddd5d44f2bf4155d0c9b6f7d05f01713b32d5d, which implements proper TLS error handling. Users are advised to upgrade to version 0.8 or later. The fix prevents SMTP connections to hosts with self-signed TLS certificates and properly validates certificate verification errors (KDE Bug).