CVE-2020-15917: claws-mail
Vulnerability summary
CVE-2020-15917 is a critical (CVSS 9.8) vulnerability in claws-mail. EPSS estimates a 2.61% chance of exploitation in the next 30 days, higher than 85.4% of scored vulnerabilities.
Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 3% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 23-07-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.61%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.61% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Opensuse5 products
- backports_sle15.0:sp1 | 15.0:sp2
- leapEOL15.1 | 15.2
- claws-mail&distro=openSUSE Leap 15.1< 3.17.3-lp151.2.3.1 | < 3.17.8-bp152.3.6.1
- claws-mail&distro=openSUSE Leap 15.2< 3.17.6-lp152.3.3.1 | < 3.17.8-bp152.3.6.1 | < 3.18.0-bp153.2.3.1
- claws-mail&distro=openSUSE Leap 15.3< 3.18.0-bp153.2.3.1
Suse3 products
- claws-mail&distro=SUSE Package Hub 15 SP1< 3.17.3-bp151.3.3.1 | < 3.17.8-bp152.3.6.1
- claws-mail&distro=SUSE Package Hub 15 SP2< 3.17.6-bp152.3.3.1 | < 3.17.8-bp152.3.6.1 | < 3.18.0-bp153.2.3.1
- claws-mail&distro=SUSE Package Hub 15 SP3< 3.18.0-bp153.2.3.1
Alpine1 product
- claws-mail< 3.17.6-r0
Claws-mail1 product
- claws-mail< 3.17.6
Debian1 product
- claws-mail< 3.17.6-1
Fedoraproject1 product
- fedoraEOL31 | 32
Mageia1 product
- claws-mail< 3.17.6-1.mga7
Ubuntu1 product
- claws-mailAll versions (No fix recorded)
8 vendors · 14 products
References
29 links- git.claws-mail.org?p=claws.git%3Ba=blob%3Bf=RELEASE_NOTESX Refsource MISC
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00090.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00002.htmlVendor AdvisoryX Refsource SUSEBroken LinkMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00060.htmlVendor AdvisoryX Refsource SUSEBroken LinkMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-09/msg00051.htmlVendor AdvisoryX Refsource SUSEBroken LinkMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-11/msg00013.htmlVendor AdvisoryX Refsource SUSEBroken LinkMailing ListThird Party Advisory
Show all 29 references
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory