CVE-2020-29547: 
Linux Debian vulnerability analysis and mitigation

An issue was discovered in Citadel through webcit-926 where Meddler-in-the-middle (MitM) attackers can exploit a vulnerability in the STARTTLS implementation. The vulnerability (CVE-2020-29547) affects multiple protocols including POP3, IMAP, and SMTP, allowing attackers to inject cleartext commands into an encrypted user session. This vulnerability was discovered during research at Münster University of Applied Sciences and was first reported in August 2020 (Vendor Advisory).

The vulnerability stems from improper handling of the STARTTLS command implementation. When a client initiates a STARTTLS connection, an attacker can inject plaintext commands between the STARTTLS command and the TLS Handshake. These injected commands are then interpreted within the encrypted context, even though they were sent in plaintext. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.9 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The primary impact of this vulnerability is the potential disclosure of user credentials. For SMTP and IMAP protocols, attackers can exploit this vulnerability to leak user credentials by injecting commands that enclose sensitive information into emails sent to the attacker. Additionally, the vulnerability enables cross-protocol attacks on servers sharing a TLS certificate with Citadel, potentially allowing attackers to host HTTPS without actually attacking TLS (Vendor Advisory).

As of the latest available information, this vulnerability remains unfixed in Citadel (Record Media). Security researchers recommend avoiding the use of STARTTLS when possible and moving to TLS-only connections as a more secure alternative.

The vulnerability is part of a broader industry-wide issue affecting STARTTLS implementations in various email clients and servers. Security researchers have advised users and administrators to move away from STARTTLS to TLS-only connections as a long-term solution (Record Media).