6.3Medium
imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS
Python Software Foundation CPython
IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treat…