CVE-2020-28896: 
NixOS vulnerability analysis and mitigation

CVE-2020-28896 affects Mutt before 2.0.2 and NeoMutt before 2020-11-20. The vulnerability was discovered when it was found that these email clients did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid (NVD). The vulnerability was disclosed in November 2020 and has been assigned a CVSS v3.1 base score of 5.3 (Medium) (NVD).

The vulnerability stems from improper handling of invalid initial IMAP responses. When encountering an invalid response, the connection was not properly closed, and the code could continue attempting to authenticate. The issue was specifically related to the connection status check rather than the 'bail' return value verification (NeoMutt Patch). The vulnerability has been assigned CWE-755 (Improper Handling of Exceptional Conditions) and CWE-287 (Improper Authentication) (NVD).

The vulnerability could result in authentication credentials being exposed on an unencrypted connection or to a machine-in-the-middle attacker. This exposure occurs because the application might attempt to authenticate without proper TLS encryption when encountering certain error conditions (NVD, Gentoo Security).

The vulnerability requires network access and high attack complexity, with no privileges required but user interaction is required. This is reflected in the CVSS vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD).

The vulnerability was fixed in Mutt version 2.0.2 and NeoMutt version 20201120. The fix involves strictly closing the connection on any invalid response during connection establishment (NeoMutt Release). Users are advised to upgrade to these or later versions. For systems running older versions, there are no known workarounds (Gentoo Security).

The vulnerability was discovered and reported by Gabriel Salles-Loustau, who also provided test cases to reproduce the issue. The fix was intentionally kept small to ease backporting (NeoMutt Patch).