Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14929
Reference (s):
- FEDORA:FEDORA-2020-386249cec2
- URL: https://lists.fedoraproject.org/archives/list/[email protected]/message/ZJLY6JDVGDNAJZ3UQDWYWSDBWOAOXMNX/
- FEDORA:FEDORA-2020-f822ea9330
- URL: https://lists.fedoraproject.org/archives/list/[email protected]/message/YFXQGKZZMP3VSTLZVO5Z7Z6USYIW37A6/
- http://mailman13.u.washington.edu/pipermail/alpine-info/2020-June/008989.html