CVE-2002-1903: Pine 4.2.1 through 4.4.4 puts Unix usernames and/or uid into Sender: and X-Sender: headers, which could all...

Security readout for executives and security teams

Pine email client versions 4.2.1 through 4.4.4 could expose a user's Unix login name or numeric uid in outbound email headers. This is mainly a privacy and information-disclosure issue, not evidence of system compromise. It may matter where usernames are sensitive or help attackers profile accounts. Exposure is likely limited to organizations still using legacy Pine 4.2.1 through 4.4.4 for outbound email. Modern mail clients are unlikely to be affected unless they are Pine-derived or preserve the same behavior, which is not evidenced in the bundle. Low urgency unless legacy Pine remains in active use or username disclosure conflicts with privacy, anonymity, or operational-security requirements. The practical response is inventory, retire or patch affected clients, and verify outbound headers. Mitigation focus: Inventory any remaining Pine 4.2.1 through 4.4.4 usage.; Review the cited Pine 4.44 privacy patch and vendor guidance.; Retire or replace unsupported Pine clients where no maintained fix exists..

Prepared

Jun 29, 2026, 19:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.