CVE-2020-15954: 
NixOS vulnerability analysis and mitigation

KDE KMail 19.12.3 (aka 5.13.3) was discovered to have a security vulnerability where it engages in unencrypted POP3 communication during times when the user interface indicates that encryption is in use. The vulnerability was assigned CVE-2020-15954 and was publicly disclosed on July 27, 2020 (NVD).

The vulnerability stems from the POP3 setup wizard defaulting to unencrypted connections. When users click on 'Check Mail' after the setup, sensitive credentials including username and password are transmitted in cleartext. The issue is classified as CWE-319 (Cleartext Transmission of Sensitive Information). The vulnerability has a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD).

The vulnerability allows attackers to potentially intercept sensitive information, including usernames and passwords, during POP3 communication. Even when users attempt to configure STARTTLS directly after setup, connections may still occur unencrypted despite the UI indicating otherwise (KDE Bug).

The vulnerability requires network access and user interaction to exploit. An attacker with the ability to intercept network traffic between the client and POP3 server could potentially capture credentials and other sensitive information transmitted in cleartext (NVD).

The issue was addressed in KDE KMail version 5.19.0. The fix ensures that TLS encryption is used when creating POP3 connections and properly checks encryption support when creating resources. For Debian 9 'Stretch', the fix was implemented in kdepim-runtime version 4:16.04.2-2+deb9u1 (Debian Advisory, KDE Bug).