UBUNTU-CVE-2021-38373

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2021-38373
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-38373.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2021-38373
Upstream
Published
2021-08-10T15:15:00Z
Modified
2025-10-24T04:50:29Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.

References

Affected packages

Ubuntu:18.04:LTS / kmailtransport

Package

Name
kmailtransport
Purl
pkg:deb/ubuntu/kmailtransport@17.12.3-0ubuntu4?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

17.*
17.04.3-0ubuntu1
17.08.3-0ubuntu2
17.08.3-0ubuntu3
17.12.2-0ubuntu1
17.12.3-0ubuntu3
17.12.3-0ubuntu4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "kde-config-mailtransport",
            "binary_version": "17.12.3-0ubuntu4"
        },
        {
            "binary_name": "kmailtransport-akonadi",
            "binary_version": "17.12.3-0ubuntu4"
        },
        {
            "binary_name": "libkf5mailtransport-data",
            "binary_version": "17.12.3-0ubuntu4"
        },
        {
            "binary_name": "libkf5mailtransport-dev",
            "binary_version": "17.12.3-0ubuntu4"
        },
        {
            "binary_name": "libkf5mailtransport5abi2",
            "binary_version": "17.12.3-0ubuntu4"
        },
        {
            "binary_name": "libkf5mailtransportakonadi5",
            "binary_version": "17.12.3-0ubuntu4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-38373.json"

Ubuntu:18.04:LTS / ksmtp

Package

Name
ksmtp
Purl
pkg:deb/ubuntu/ksmtp@17.12.2-0ubuntu1?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

17.*
17.12.2-0ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libkpimsmtp-dev",
            "binary_version": "17.12.2-0ubuntu1"
        },
        {
            "binary_name": "libkpimsmtp5",
            "binary_version": "17.12.2-0ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-38373.json"

Ubuntu:20.04:LTS / kmailtransport

Package

Name
kmailtransport
Purl
pkg:deb/ubuntu/kmailtransport@19.12.3-0ubuntu1?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

19.*
19.04.3-0ubuntu1
19.04.3-0ubuntu2
19.12.3-0ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "kde-config-mailtransport",
            "binary_version": "19.12.3-0ubuntu1"
        },
        {
            "binary_name": "kmailtransport-akonadi",
            "binary_version": "19.12.3-0ubuntu1"
        },
        {
            "binary_name": "libkf5mailtransport-data",
            "binary_version": "19.12.3-0ubuntu1"
        },
        {
            "binary_name": "libkf5mailtransport-dev",
            "binary_version": "19.12.3-0ubuntu1"
        },
        {
            "binary_name": "libkf5mailtransport5abi2",
            "binary_version": "19.12.3-0ubuntu1"
        },
        {
            "binary_name": "libkf5mailtransportakonadi5",
            "binary_version": "19.12.3-0ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-38373.json"

Ubuntu:20.04:LTS / ksmtp

Package

Name
ksmtp
Purl
pkg:deb/ubuntu/ksmtp@19.12.3-0ubuntu2?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

19.*
19.04.3-0ubuntu1
19.04.3-0ubuntu2
19.12.3-0ubuntu1
19.12.3-0ubuntu2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libkpimsmtp-dev",
            "binary_version": "19.12.3-0ubuntu2"
        },
        {
            "binary_name": "libkpimsmtp5abi1",
            "binary_version": "19.12.3-0ubuntu2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-38373.json"