Hi,

The following vulnerability was published for offlineimap3.

CVE-2020-37248[0]:
| OfflineIMAP before 8.0.3 trusts the server with their STARTTLS
| capability prior to authentication, which allows STRIPTLS/man-in-
| the-middle attacks, taking over the connection and extracting
| account credentials in cleartext.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-37248
https://www.cve.org/CVERecord?id=CVE-2020-37248
[1] https://github.com/OfflineIMAP/offlineimap3/issues/222
[2] https://github.com/OfflineIMAP/offlineimap/issues/669
[3] https://github.com/OfflineIMAP/offlineimap3/commit/46505c53ef995455d66c685f9ec3ff6ea93dbb74

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
offlineimap3, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1139329@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sudip Mukherjee <sudipm.mukherjee@gmail.com> (supplier of updated offlineimap3 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 19 Jun 2026 20:35:16 +0100
Source: offlineimap3
Architecture: source
Version: 8.0.3+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Closes: 1127107 1139329
Changes:
 offlineimap3 (8.0.3+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 8.0.3+dfsg
     - Fixes CVE-2020-37248. (Closes: #1139329)
     - Fixes encoding errors. (Closes: #1127107)
Checksums-Sha1:
 d0e791cdbe8d75636c4a08323023f7b1fd6a939d 2379 offlineimap3_8.0.3+dfsg-1.dsc
 a4b06055697e2e8533db4de6c3692e2ad5988d02 183384 offlineimap3_8.0.3+dfsg.orig.tar.xz
 91c842db94313654684d64100172971b3caefe3b 7396 offlineimap3_8.0.3+dfsg-1.debian.tar.xz
 1fe90b15cf8aa59100fb6615a45b9a77c21c86fe 7951 offlineimap3_8.0.3+dfsg-1_amd64.buildinfo
Checksums-Sha256:
 a9801a8cd6d0afc6d79e969ff23eb04511739c4135a2ceaf88734a016585083d 2379 offlineimap3_8.0.3+dfsg-1.dsc
 8259846849fa6946320435071ceeb1fd072d96a8aff23bf9db339b8de4e90939 183384 offlineimap3_8.0.3+dfsg.orig.tar.xz
 1ef708a76e4a08c84276bf981fe503bc32e3f79c7df749dcf8403ee5d5ea1358 7396 offlineimap3_8.0.3+dfsg-1.debian.tar.xz
 2d20bb779ddba6f25963cf71ea8a30effd025312acbb0298368551f28dbec740 7951 offlineimap3_8.0.3+dfsg-1_amd64.buildinfo
Files:
 6928fc713d8ec15b669820fdae215966 2379 mail optional offlineimap3_8.0.3+dfsg-1.dsc
 6de8108fdce7729abc0372de7facd703 183384 mail optional offlineimap3_8.0.3+dfsg.orig.tar.xz
 932ecde0b7f8e8118ee71774f7e8fc9d 7396 mail optional offlineimap3_8.0.3+dfsg-1.debian.tar.xz
 78f49fa7bb58857d06b5475655cdfead 7951 mail optional offlineimap3_8.0.3+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEuDQJkCg9jZvBlJrHR5mjUUbRKzUFAmo1m4IACgkQR5mjUUbR
KzVERBAAp2UOt0mKpQ8ZGwVehjIKHrz/YHgUAVVsM9/9ibsZi14OCMuHVb7IYAmd
C7yNlCgCp2hmJAOZ/LLB6Nk4rOkGS31HC5gg97vTy3RFiCklaejQdejnyv/A78V1
xskO0PLsdBMWoBjsU1r7O1V8L89TO75eGk//E8S8RzOK7c4ASA7y/JAQlc2mfDrD
xd6DLXLucC2MQiQBWGoeGNDOUTbh3NSdfvvpl9J1tNM6zh51SyYw2trvKRQo42JX
hnInANgzTsvbtGdUFmUek/QQvmT1G/0ejZx5xIC5mkIYp3LNysazDD1v3lacF8yE
yicGQuL2WPf1vGyuT4ipgtRKgQnK/LZ+USOubR9fOU6DC+Xs4Qn0mWU6CukS/upn
ynf5WDzG60bgsF+SY6eHaIF60/AGkUKpPSn/6pHOXA5aUkKdvdD9bUM59xobLWE0
Vr6+otVrSQfOPXVTwPWlmts1MoqYgJveZlPZM0HPZivoKOk6OOf7/bdwc1+ObGJ0
vQX2vlwlwuPURcPOL44LhoCHu3jUaUw9evIYAqPtJEFLpSmbMmHZZTyAg4CLCDkX
PpSzhAYQp/7E/e78NpXBiVdC0qIeV/FbUS1w/Ut5N0uqkBwfsFH6rpsIcmZacfTC
vP9cj0Y9I+c2mBTjNKG120Ux3ud8hiCIkIHnJYoAnsdZjVV3rmY=
=lg/m
-----END PGP SIGNATURE-----