SECURITY ANNOUNCE (INTERIM): fetchmail users should configure --ssl wherever available, and also require at least TLS1.2

--===============7968831139666333070==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="Oz7t3yhYM4yZlcdV"
Content-Disposition: inline


--Oz7t3yhYM4yZlcdV
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

all released fetchmail versions to date (up to and including 6.4.21)=20
were found susceptible to some sorts of attacks against STARTTLS (IMAP)=20
or STLS (POP3), which can lead to a session that remains unencrypted=20
even though --sslproto tls1.2+ or similar configurations require=20
encryption, and worst case exposing the user's login credentials and=20
also e-mail when the configuration tells otherwise.

The solution in fetchmail code requires thorough reviews and
changes that will take more time.  Remember that fetchmail is=20
a volunteer spare-time project.

The details of the implementation and concept flaws shall be disclosed=20
later in the formal fetchmail security announcement 2021-02 (not yet=20
published).

MITIGATING THE IMPACT:=20

Proper configuration for Implicit TLS can mitigate the impact for many=20
users.  I am already announcing such configuration changes below:

------------------------------------------------------------------------
Everyone whose server supports "Implicit TLS", meaning TLS on=20
a dedicated imaps port (TCP port 993) or pop3s port (TCP port 995),=20
should reconfigure fetchmail to enable this option (ssl or --ssl)=20
permanently.
This can be achieved in two ways, either of which alone is sufficient:

- on the command line, add --ssl), which will affect all servers=20
  included in the poll (=3D all poll statements from the rcfile, or all=20
  servers mentioned on the same command line).

- in the rcfile, by adding the word "ssl" without quotes after each
  configuration stanza for a user description.

After making the change, test your new configuration before enabling=20
unattended operation.


Future directions: 1. The Internet Engineering Task Force (IETF) has=20
proposed standards that consider both STARTTLS obsolete (RFC-8314) and=20
deprecate TLS 1.1 and earlier (including all SSL versions) (RFC-8997).

2. I may make Implicit TLS the default in future fetchmail releases,
and promise to at least bump the minor version to >=3D 6.5.0 in that case.
------------------------------------------------------------------------

I will also add an *unrelated* recommendation while we are at it and=20
users are suggested to edit their configurations anyways:

I suggest that everyone configures fetchmail to negotiate at least TLS=20
v1.2 if supported by the server, or at least TLS v1.2, which can happen=20
on the command line through --sslproto TLS1.2+ or in the rcfile by=20
adding sslproto TLS1.2+ in each stanza after each user statement.

Where possible, meaning server-side support and support by the local=20
OpenSSL library version (for instance, 1.1.1 is good enough), fetchmail=20
can also be configured to require TLS v1.3 or newer instead, in that=20
case, use --sslproto TLS1.3+ on the command line or sslproto TLS1.3+ in=20
the rcfile.


future direction: fetchmail 6.5 and newer (not yet released and several=20
weeks to months out) will make TLS 1.2 the minimum required version, and=20
will also require an OpenSSL library that supports TLS 1.3.
------------------------------------------------------------------------


Note that the changes proposed above, when successfully deployed, can=20
remain in place when fetchmail 6.4.22 will be released, so there is no=20
need to wait.

--Oz7t3yhYM4yZlcdV
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmEZJ2oACgkQ5BKxVu/z
hVqTzw//XX+X2LlfeFnJBvutHKUrb/gBusf3hZyqot3v7GPf3hEZjlWfS25PnUSU
iBkXL2G0EIzXn19chYRwznsQPFURoregn3BrIhqRy78PgRXlAy8w1U+xzuVipGmU
81kni8jSLi9Y8V32GvJEm9qSWylw1T8FNy1EeqLuo/ayjI8KA2LZD8np8r5f8xL2
0P491M8k2adh8oNwSJT27uzNjW8Cf06ecUzs7ivnOCWQCQU3kRp1ler/y6IdsfFF
qy+vf7/0DeTRRRmnXxIJtCRXjArgzgS31wFxN/Da4DQMlvKGZ4SzDjAP1Ct2qJiZ
2h7IPFIdDdrmIINm6qQQcIfzmHSU9JZQs2W42TD1vujAfSHamaJlvTELBIfWz+Oa
qgOlUkhtM7tMJHWjfTukC7Kqd0gasofri3JZlg3rvMM50oyJV736iXU/MohOROZo
pkiqYUUXaxIglul11gxeM9We9iVyXdna4wu8tyFmmE8cHjrLSYK1iyENTeg7vfzp
g0imWAq/J/JqSJtYnLkocETHNx1eaIC0Jeyv+3L1+yrmjvfq55WPk5pJRuOSmfM0
c1rZXHj/RM/Sa6cobvKgeT+wtetim4IwcpPOgNfB2rxlDy0lr42tI74ywr44tI72
lEYn/RuXA5xvV8YWiVEH2GaNPcFyQ/KuZJkU5nu6kFDQeFv3trI=
=tmpp
-----END PGP SIGNATURE-----

--Oz7t3yhYM4yZlcdV--


--===============7968831139666333070==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============7968831139666333070==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Fetchmail-announce mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fetchmail-announce

--===============7968831139666333070==--