severity 337085 normal
thanks

Hello Kees,

On Wed, 2005-11-02 at 07:53 -0800, Kees Cook wrote:
> Severity: grave
> Justification: renders package unusable

> squirrelmail uses the wrong prefix for SSL imap connections.  This is
> reported (and fixed) here:

I'm sorry, but this does not render the package unusable in any
interpretation. Please note that in the vast majority of installs,
SquirrelMail either connects to an IMAP server (1) on the same host, or
(2) on a fully controlled network. In both cases, there's absolutely no
advantage in using SSL. The SSL functionality is only needed when
connecting to a remote IMAP server.

> http://libarynth.f0.am/cgi-bin/twiki/view/Libarynth/SquirrelMail
> 
> /usr/share/squirrelmail/functions/imap_general.php
> line 441
> - $imap_server_address = 'tls://' . $imap_server_address;
> + $imap_server_address = 'ssl://' . $imap_server_address; 

Otherwise, thank you for your report, I will check this out with
upstream to see what's going on here.


regards,
Thijs Kinkhorst

Attachment: signature.asc
Description: This is a digitally signed message part

Reply via email to