4 files changed, 42 insertions, 8 deletions
diff --git a/mail-client/mutt/Manifest b/mail-client/mutt/Manifest
index 399d3b9e6627..e3837d8d2411 100644
--- a/mail-client/mutt/Manifest
+++ b/mail-client/mutt/Manifest
@@ -1,12 +1,13 @@
 AUX Muttrc 667 BLAKE2B 49aaefba7ceeefde9d727ad88574fc599a48bcd334ac8e99d8d5e555f2317f4595c480f1903df4b82854bfd272b8aee86a02369769f38a3cadf35f6a6348bf14 SHA512 b64d6e857f0c7de2e2e5b23cecd869f8a9807aa827ad6221e3c5864b2a31fb0136aeaf09ffdb2549645507fe92f724774a80395b6ab2345068903f5ee1269f29
 AUX Muttrc.mbox 486 BLAKE2B dd7f15b08f185800b2a7d26545e5a1b0f7b21f8f7cff2b4fce39fb58d8e336bec6fd500b88c0b14d026c9578d12cd1e4bca45c0d2f3d286d2c9d132b2b5e137e SHA512 aece9a734d292b6f638d2a0dd39f20d9894b4bb6e6888da606a49274faef9c1864e98eec907ffa7742af58d46456e46b8945d2d47c8b89fc95daa2a8833d3e90
+AUX mutt-1.14.4-no-imap-preauth-with-tunnel.patch 1001 BLAKE2B 20d5210ca085d26270be5588fa8058068715e91461832bbf09e21213cc6e84d7b118437a7e11a1e1202af7c3b76edc0f33d5fef2e3b61cd47cd2ddc03a578723 SHA512 07c243290f266b1446f83448796c1871234f38f05f0586cd1360bc6d80088a693451d7f85123da04004489d12d99191196c9bbf5291e90875955f05eb87fff02
 DIST mutt-1.13.5.tar.gz 4902500 BLAKE2B 24c7f40ca177a64118f30d3ea1af95ebbf88c4e9b53a12bab058544350606b85d47ed659eab5f59e5bf17964843243ce175b6e0f0571baca93367ed1bc866a94 SHA512 f2ea863626e5dad4854c98a1797faa97c9f14fb5161c590e88ee02afbdde7f48493bd2cce6109f9839501cf38aa238dc804f4c98f17ac97c68b48cb0bc0e5b4a
-DIST mutt-1.14.0.tar.gz 5220515 BLAKE2B 4a9b70f0d32df1a33947898b71044a97b9cbca04ba0c01f06cae967cb9dff6fa06dd005c7f0e0642654a4cef04686eb38af7c032aa361f0e3f2f57faf66d93d4 SHA512 66eddad7a9ce0c067795b8f0285159a6aa7fbf9304ef287888f1c86a942d565e1f71294549e22960a4db8bcc06b1e9f6690c3e04dedf8b37d304b4aa6a250225
-DIST mutt-1.14.2.tar.gz 5222938 BLAKE2B e59dd4e1e61380a3c49fce8d722e7a263e81713208660e28629f428bc13724ccc80cffb3345ec1b8dd0a8aefa32ccdea94b8098b826268ce0fe64f6a11bdfec5 SHA512 b18b0bc52341d31a60558ca9b11545f5352e89bf7c215b10061efcd382af287416299f7efa017e3a03937a11fd630330ff8389dbe80fae2e6437297687653cb8
+DIST mutt-1.14.3.tar.gz 5003987 BLAKE2B 43e9be05e3da6f3c257bc405fdf45b87114efdeece169d2919390b5cf35a935d1c2798b0ab7eb213eb25eed3008e452fc4c9f02ca8fdb209dce8d9655fe7fb84 SHA512 d7ac53cd383e7491666aeb0b33703dee47cfb9a8671484b713f3b5051227ca2fa618320df0267b7d4eb43a22f9fc9d20d457ddb3f98f907ce49fe7f2915a865e
+DIST mutt-1.14.4.tar.gz 5007437 BLAKE2B 89d4327ddd86ec320c63db6ee9d3c07b7540a74aba7efdcb9605e5c5c242dec99fb5137d1cfc62fd4401e2af7589f03ebce78dfa2deae262aef408b804544656 SHA512 86484f009ca8bd1e26206694e03609a16f8a4e8c83620a07a4376fe160535a838e8c918a8a30799fb3d9cf46c059d67124f7425c42093fb5e5bf8ea4ac310daa
 DIST mutt-gentoo-1.13.5-patches-r0.tar.xz 35932 BLAKE2B 7f4488e6478ba2a2593a58d9905fd8cb857d95a7c05dd90d7d08843bafc060c0560fc5061a85a0a91baf063f055139fa09e5a54ea353e0118418f73baa333928 SHA512 1ddad0550a9bc772247d5ca468efd044c9eeccb497cbe391b19382d598fd0ec8dbdb3d34d4297cc5cd3a8ff43c881155a5874db24e89c0f2a4702b6e0ba4f0d9
-DIST mutt-gentoo-1.14.0-patches-r0.tar.xz 31124 BLAKE2B e5703fb22d627cac2fd7ef9565c10a46ccd3153611335aa3051b1d38feb68b52fb0bd0a1360c02fa0723bedbdaa2b4000020546f3f5bf039b5e9578c6481cf6f SHA512 1c89d6843392ad9db869dce9c90a04cb712bf3c783797f231749fddee6047e5ec79513abca644e76e3f28c4af2e94f055ab72a794f4ba6a971d2f668c6b6a1ff
-DIST mutt-gentoo-1.14.2-patches-r0.tar.xz 31076 BLAKE2B 31bb4efd03f45b4b79ed325471166e91f0e419318f3cf1e5426a627e2557bf19fbe03ae2c19cc97719c574b6a8df19b96955429651bffb41d5220888553b86a9 SHA512 5a0ddf0242caed5bed19700904b0fd91883542b9b12f0b16c1b4f7f39944d0737429991cca7cbf4f9932deada8b7fd71caff284775ddfcf3ec283554d3e727a9
+DIST mutt-gentoo-1.14.3-patches-r0.tar.xz 31148 BLAKE2B 49f5f7b446d635de31e5280bad09422bcf27543b58e2eade6ddec35524e9c49083fe59224e6103d6992f53571d77c606c6280e58d05606900ed01ccbd4c4d697 SHA512 444f6456b3c1eb423cd990c3f5a7f4f6ce7f0706f461ca507846ce6ee855e32331720bc7c0fa2cb834d5433d9e7a0d7d2d90c5b8c0ac917dbd3c63a622ae6ce5
+DIST mutt-gentoo-1.14.4-patches-r0.tar.xz 31124 BLAKE2B a9774a5bb5af18a275f7ea171cb08a12a98d63cbff57320d5d3fb4f995aac16f409689ac0015f3b5d37cfc20004c9fca72a3f63663aaa679a129d5f3886bc5cc SHA512 05506399a471c262479db88ef11d2a95d79598fd696fe50de5f5c1c3cae5adf30a2806a1500ba94a62bcbf7deed99acc59a8afb903f50169e41b77010e0ad8cc
 EBUILD mutt-1.13.5.ebuild 8370 BLAKE2B 73455bc38f547ad43a1fcd3eeca0f7bb3841fd9c03d1e76a4e9d7871d62a0f7867b4a27f78d209dcca177dd0b20dc5c404939f74153ef0efb6b0560564cc6aef SHA512 a5e12b65007bb43fcf329617a512fb6bb268bdf365df322c7869bc075c03df8ee67e206160a488d73bd0b8d5b4e50f23c4d7409cf0e84ac3ac53d5bd339a10a3
-EBUILD mutt-1.14.0-r1.ebuild 8238 BLAKE2B df3056665c7828775ca8ff1cb9999a6aeb48a6218df128e07798a7c01c2672f5806f26b3c9869adb20af3d9ff4d48da422a59a118fba5b00a268588315abf03a SHA512 e7113be3b0f73c143b439fd6214734cd35af06a09bf6ed37596db9bc2b73913b7272b9b05c68364cd3e8dc00ac67d5ccb009dc7dd8793e251b81e580c39cf62e
-EBUILD mutt-1.14.2.ebuild 8238 BLAKE2B df3056665c7828775ca8ff1cb9999a6aeb48a6218df128e07798a7c01c2672f5806f26b3c9869adb20af3d9ff4d48da422a59a118fba5b00a268588315abf03a SHA512 e7113be3b0f73c143b439fd6214734cd35af06a09bf6ed37596db9bc2b73913b7272b9b05c68364cd3e8dc00ac67d5ccb009dc7dd8793e251b81e580c39cf62e
+EBUILD mutt-1.14.3.ebuild 8236 BLAKE2B 1a7f0c1b474f07992db19acd9ca1f4373435aa44cf06cd6f8b12066744f2bc559d11d83197b01d96634aba6b2d0e6495766adf0352c07a52334093ae6b13adfa SHA512 03e84726da1c032f536d81e55e111f899ed4b41bfb1462475fb4dfa7e642b0f8a03f6001ecd8ef647c97a1bb0ec849331a0781b0696726812d31aae8a791a114
+EBUILD mutt-1.14.4-r1.ebuild 8348 BLAKE2B 07dd0155ea61216acee9a8ded3a9e21bbe5c98f1a7c3ccad526823ba6c5bf90a5d926fc2c03dc903bac1ab20f690be858c0274bae41c38fb9a25cdf8ba5dcb30 SHA512 2e5e4b9842f1142de9c3f9b109a5ade95ca35bc7a62de867d690934702b9acbe292dff32d266c057e1337d19942657f8bdc0071a7e9e0a9f6c0b805c9ebd2aac
 MISC metadata.xml 1297 BLAKE2B 67419e66fa917ae69f015d9af534edeb809c4371b2c004c6687a942f331c70ad0513fedb8b6f45a2cb7fc5bfd9ca80c91f888e58293dee00c198d2bca7b8cb12 SHA512 9d9c30b14ce952f8099fb60eac3e8dc25e1c5ef05b88b71c1207950766cb367b56cf7c60168c6f3e431e1aa823c0a345ce851414705e9f0af015cfa51e241350
diff --git a/mail-client/mutt/files/mutt-1.14.4-no-imap-preauth-with-tunnel.patch b/mail-client/mutt/files/mutt-1.14.4-no-imap-preauth-with-tunnel.patch
new file mode 100644
index 000000000000..d4d2104db08c
--- /dev/null
+++ b/mail-client/mutt/files/mutt-1.14.4-no-imap-preauth-with-tunnel.patch
@@ -0,0 +1,30 @@
+From dc909119b3433a84290f0095c0f43a23b98b3748 Mon Sep 17 00:00:00 2001
+From: Kevin McCarthy <kevin@8t8.us>
+Date: Sat, 20 Jun 2020 06:35:35 -0700
+Subject: [PATCH] Don't check IMAP PREAUTH encryption if $tunnel is in use.
+
+$tunnel is used to create an external encrypted connection.  The
+default of $ssl_starttls is yes, meaning those kinds of connections
+will be broken by the CVE-2020-14093 fix.
+---
+ imap/imap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/imap/imap.c b/imap/imap.c
+index 3ca10df4..78d75b07 100644
+--- a/imap/imap.c
++++ b/imap/imap.c
+@@ -532,8 +532,8 @@ int imap_open_connection (IMAP_DATA* idata)
+   {
+ #if defined(USE_SSL)
+     /* An unencrypted PREAUTH response is most likely a MITM attack.
+-     * Require a confirmation. */
+-    if (!idata->conn->ssf)
++     * Require a confirmation unless using $tunnel. */
++    if (!idata->conn->ssf && !Tunnel)
+     {
+       if (option(OPTSSLFORCETLS) ||
+           (query_quadoption (OPT_SSLSTARTTLS,
+-- 
+GitLab
+
diff --git a/mail-client/mutt/mutt-1.14.0-r1.ebuild b/mail-client/mutt/mutt-1.14.3.ebuild
index 655ecdfe2af2..1080859254bb 100644
--- a/mail-client/mutt/mutt-1.14.0-r1.ebuild
+++ b/mail-client/mutt/mutt-1.14.3.ebuild
@@ -27,7 +27,7 @@ REQUIRED_USE="
 	autocrypt?        ( gpgme )"
 SLOT="0"
 LICENSE="GPL-2"
-KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm hppa ~ia64 ~mips ~ppc ~ppc64 sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 # yes, we overdepend on the backend impls here, hopefully one day we can
 # have REQUIRED_USE do what it is made for again. bug #607360
 CDEPEND="
diff --git a/mail-client/mutt/mutt-1.14.2.ebuild b/mail-client/mutt/mutt-1.14.4-r1.ebuild
index 655ecdfe2af2..2a138c892046 100644
--- a/mail-client/mutt/mutt-1.14.2.ebuild
+++ b/mail-client/mutt/mutt-1.14.4-r1.ebuild
@@ -27,7 +27,7 @@ REQUIRED_USE="
 	autocrypt?        ( gpgme )"
 SLOT="0"
 LICENSE="GPL-2"
-KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 # yes, we overdepend on the backend impls here, hopefully one day we can
 # have REQUIRED_USE do what it is made for again. bug #607360
 CDEPEND="
@@ -74,6 +74,9 @@ RDEPEND="${CDEPEND}
 src_prepare() {
 	local PATCHDIR="${WORKDIR}"/mutt-gentoo-${PV}-patches-${PATCHREV}
 
+	# really unfortunate security fix of the day ...
+	eapply "${FILESDIR}"/${P}-no-imap-preauth-with-tunnel.patch
+
 	if use !vanilla ; then
 		# apply patches
 		export EPATCH_FORCE="yes"