My mail provider has informed me that Pegasus is using TLS 1.0 or 1.1 when connecting via POP and SMTP. Those protocols will be discontinued in the next few weeks and it will cut Pegasus off any eMail exchange.
The minimum standard is TLS 2.0.

I can not find any setting in Pegasus where you could select the version of TLS. The only setting I can find is where you can select DirectSSL.

Any help or advice?
Thank you

Significant new OpenSSL build This version includes OpenSSL 1.1.1k, which is the absolute current version at the time of release. Moving to OpenSSL 1.1.1 is an important long-term functionality update that will keep Pegasus Mail in step with connection security for a long time.

Hi Michael,

Many thanks for the info, that's quite helpful.
I actually meant 1.2, the 2.0 was a typo.

It looks that I just have to update.
Thanks again!

Be advised of the following issues in v4.80:

1. The v4.80 spell checker is broken for user added words. Those words are supposed to be stored in USRDICT5.PMD but that file gets emptied each time the spell checker is invoked. User saved words are lost after upgrading to 4.80 and running the spell check. Attempts to add words fail. The workaround is mark the USRDICT5.PMD file as read-only so that it can't be modified. If its content has already been deleted, restore an old USRDICT5.PMD file from backup and mark it read-only.

2. Multiple issues with IERenderer that can be fixed with an update. You should do this as soon as possible. The current version is available here: https://www.pmpgp.de/renderer/IERenderer.zip

Attn: Michael
Pmail implemented is Open SSL 1.1.1.
Since there is also OpenSSL 3.01(latest), can you shed a light on this. OpenSSL recommend this version to install together with V1.1.1. Is this an issue for Pmail?

Thank you

If you understand any of the Fips related section you would have the answer, I don't (except for being about certification).

For Info. Don't know if it would make a difference.
Long ago, I had issues with an older version of Pegasus version of ssl.
I opted to try using stunnel to handle the connection.

stunnel -help
Initializing inetd mode configuration
stunnel 5.69 on x86_64-redhat-linux-gnu platform
Compiled/running with OpenSSL 3.0.8 7 Feb 2023
ThreadingTHREAD SocketsOLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI

Requires setting up an stunnel.conf to have pegasus use a local port that stunnel uses to connect to the ssl port, so Pegasus thinks it is a non-ssl port.

My stunnel.conf for my gmail and local isp connections.
[gmailpop]
client=yes
accept = 127.0.0.1:20995
connect = pop.gmail.com:995
debug = 3

[gmailsmtp]
client=yes
accept = 127.0.0.1:20465
connect = smtp.gmail.com:465
debug = 3

[gmailimap]
client=yes
accept = 127.0.0.1:20993
connect = imap.gmail.com:993
debug = 3

[guampop]
client=yes
accept = 127.0.0.1:20996
connect = mail.guam.net:995
debug = 3

[guamsmtp]
client=yes
accept = 127.0.0.1:20466
connect = smtp1.guam.net:465
debug = 3

The help shows Pegasus 4.80 upgraded to 1.1.1k.

Know there is windows versions of stunnel and it loads the openssl stuff (I believe)

I run Pegasus under Linux using wine, but should be same.
The versions I currently have are:
openssl1.1-1.1.1q-1.fc36.x86_64
openssl-libs-3.0.8-1.fc36.x86_64
openssl-3.0.8-1.fc36.x86_64
openssl-devel-3.0.8-1.fc36.x86_64
openssl-libs-3.0.8-1.fc36.i686

Pegasus use to have separate dll files that could be updated, but now believe they are included in build. So only new version of Pegasus can update them inside.

Don't know if that gives any information you can use. Good Luck.

I think Pmail have to change anyhow, latest mid of the year, to the newer OpenSSL 3 Version due to EOS of 1.1.1.
And by the way we the version 1.1.1 is already with several security and bugfixes at version 1.1.1t

Note from Open-SSL-Website: "The previous LTS version (the 1.1.1 series) is also available and is supported until 11th September 2023"
https://www.openssl.org/

IOW: As long as TLS 1.3 is covered and not "deprecated" there's no need to enforce another update especially since the OpenSSL 3 versions apparently just provide a special administrative US certification which doesn't mean there's a technical advancement in there as far as I understand this: It has to follow certain rules to achieve this, that seems to be its purpose.

PMail v4.81b user
TU all for the extended info on OpenSSL/Pmail.

Another question: Should there not be a PMail 5.0 version or is pm virt dead and will v4.81b be sufficient for the future, xmt OpenSSL updates?

Greetings

I think that Pegasus only using a few functions out of OpenSSL and give not so much attack vectors to malware or hackers.

So I hope that Pegasus will not use those parts of OpenSSL which are affected by the latest vulnerabilities. And also will not be affected when the LTS version 1.1.1 is no longer maintained at all from October.

Just for info, the CVE for OpenSSL contain some critical ones that also affect v1.1.1k, that hopefully not impact Pegasus at all .
https://www.cvedetails.com/vulnerability-list/vendor_id-217/product_id-383/year-2022/Openssl-Openssl.html

Michael in der Wiesche asked me to comment on this topic, so here's the situation.

• V4.80 and v4.81 support OpenSSL v1.1.1, which has complete support for TLS 1.2 and 1.3. Since TLS 1.3 is not currently in widespread use, this should mean that things will remain valid for a period measured in years.

• I am actively watching the development of OpenSSL v3.0 and once I'm sure it's frozen and stable (it's still undergoing active development), I'll begin switching the Pegasus Mail OpenSSL support code over to it. The current plan will be to offer two versions of the OpenSSL support, defaulting to v1.1.1 until it reaches EOL, but making v3.0-based builds available to anyone who would prefer to use them.

• I have resisted updating to more recent versions of OpenSSL v1.1.1 until I was certain they were stable: version 1.1.1r (I think that was the version) was withdrawn with issues, and I've been waiting for the dust to settle down after that. I may look at including v1.1.1t support in the full release version of Pegasus Mail v4.81.

• OpenSSL support in Pegasus Mail is modular, meaning that I can update it without having to update the whole program around it. This means that keeping OpenSSL support current is not a complicated process.

As another poster noted, Pegasus Mail uses only a fairly small subset of OpenSSL's capabilities, and none that are currently covered by vulnerability notifications (at least as far as I am aware). My own personal view is that SSL-based exploits will tend to be specialized by their very nature, and that they are not something most users need to be very concerned about.

I hope this covers peoples' questions on this topic.

-- David --

thanks for the clarification