CVE-2020-37248

Publication date 9 June 2026

Last updated 9 June 2026

Ubuntu priority

Cvss 3 Severity Score

Description

OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle attacks, taking over the connection and extracting account credentials in cleartext.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
offlineimap3	26.04 LTS resolute	Needs evaluation
	25.10 questing	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation

How can I get the fixes?
What do statuses mean?

Severity score breakdown

CVSS version: CVSS v3.0

Base score 6.5 · Medium

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	Low
Availability impact	None

Scores

Parameter	Value
Base score	6.5 · Medium
Exploitability score	-
Impact score	-

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

MITRE
NVD
Launchpad
Debian

Other references

https://www.cve.org/CVERecord?id=CVE-2020-37248
https://github.com/OfflineIMAP/offlineimap3/issues/222
https://github.com/OfflineIMAP/offlineimap/issues/669
https://github.com/OfflineIMAP/offlineimap3/commit/46505c53ef995455d66c685f9ec3ff6ea93dbb74
https://pypi.org/project/offlineimap/#history
http://www.openwall.com/lists/oss-security/2026/06/08/3