After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 655088 - imapx provider sends password in plaintext over insecure connection when sending mail
imapx provider sends password in plaintext over insecure connection when send...
Status: RESOLVED DUPLICATE of bug 648277
Product: evolution-data-server
Classification: Platform
Component: Mailer
3.0.x (obsolete)
Other Linux
: Normal critical
: ---
Assigned To: evolution-mail-maintainers
Evolution QA team
evolution[imapx]
Depends on:
Blocks:
 
 
Reported: 2011-07-22 00:05 UTC by Travis Reitter
Modified: 2011-08-31 16:00 UTC
See Also:
GNOME target: ---
GNOME version: ---



Description Travis Reitter 2011-07-22 00:05:59 UTC
With the imapx backend and both incoming and outgoing connections set to TLS encryption, my password gets sent in plaintext (over a non-SSL/TLS connection) to the IMAP server at the time I send an email. I'm not sure why it's opening an IMAP connection at that point. I've confirmed that it's sent in plaintext by running dsniff on the appropriate interface.

This problem doesn't happen with the regular IMAP backend. And a colleague (using the same server) cannot reproduce the problem with Evolution/EDS 3.0.2-0ubuntu1~natty1 (I'm using 3.0.0-1 from Debian experimental).

This bug seems similar to another bug that was fixed quite a while ago: bug #350617

Symptoms:

Error message after mail is sent
================================

Your message was sent, but an error occurred during post-processing.

The reported error was "Failed to append to treitter@<mail server>:Sent: No output stream
Appending to local 'Sent' folder instead.".

======================================

Then Evolution keeps asking me for my IMAP password. Entering even my correct password results in the following password prompt continuously until I close it:
======================================

Unable to authenticate to IMAP server.
IMAP command failed:[CLIENTBUG] Plaintext authentication disallowed on non-secure (SSL/TLS) connections.
======================================

It looks like my mail server is doing the right thing in rejecting this plaintext password over an insecure connection.
Comment 1 Akhil Laddha 2011-07-22 05:06:10 UTC
(In reply to comment #0)
> Symptoms:
> 
> Error message after mail is sent
> ================================
> 
> Your message was sent, but an error occurred during post-processing.
> 
> The reported error was "Failed to append to treitter@<mail server>:Sent: No
> output stream
> Appending to local 'Sent' folder instead.".
> 

This has been fixed already in bug 638307
Comment 2 Milan Crha 2011-08-31 16:00:11 UTC
Thanks for the bug report. This particular bug has already been reported into our bug tracking system, but please feel free to report any further bugs you find.

*** This bug has been marked as a duplicate of bug 648277 ***