CVE-2020-14929 — Sensitive Information Exposure in Project Alpine

CWE-200 — Sensitive Information Exposure8 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 40.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Alpine Project AlpineDebian AlpineDebian Linux+1 more
Timeline
PublishedJun 19
Latest updateMar 20

Description

Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/alpine< alpine 2.23+dfsg1-1 (bookworm)
▶Debianalpine_project/alpine< 2.23+dfsg1-1+3
▶Ubuntualpine_project/alpine< 2.20+dfsg1-2ubuntu0.1~esm1+2

Also affects: Debian Linux 8.0, Fedora 31, 32

Patches

Patch: mailman13.u.washington.edu ↗Patch: mailman13.u.washington.edu ↗

🔴Vulnerability Details

3
OSV
alpine vulnerabilities↗2025-03-20
▶
GHSA
GHSA-2h9h-wfvh-5r96: Alpine before 2↗2022-05-24
▶
OSV
CVE-2020-14929: Alpine before 2↗2020-06-19
▶

📋Vendor Advisories

2
Ubuntu
Alpine vulnerabilities↗2025-03-20
▶
Debian
CVE-2020-14929: alpine - Alpine before 2.23 silently proceeds to use an insecure connection after a /tls ...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-14929 alpine: silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH [fedora-all]↗2020-06-23
▶
Bugzilla
CVE-2020-14929 alpine: silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH↗2020-06-23
▶