PT-2018-10945 · Enigmail+1 · Enigmail+1

Marcus Brinkmann · Publicado 2018-06-13 · Atualizado 2024-06-15 · CVE-2018-12019

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Enigmail versions prior to 2.0.7

Description The issue concerns the signature verification routine, which incorrectly interprets user ids as status/control messages and fails to track the status of multiple signatures. This allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

Recommendations For versions prior to 2.0.7, update to version 2.0.7 or later to resolve the issue.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2018-12019

MGASA-2018-0316

MGASA-2018-0321

MGASA-2018-0354

OPENSUSE-SU-2018_1708-1

OPENSUSE-SU-2024:10736-1

SUSE-SU-2018:2243-1

Produtos afetados

Enigmail

Suse

Referências · 43

• 🔥 https://enigmail.net/index.php/en/download/changelog · Exploit
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf · Nota
• https://github.com/RUB-NDS/Johnny-You-Are-Fired · Nota
• https://bugzilla.suse.com/1094781 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10736-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2018-0321.html · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=23277 · Nota
• https://lists.opensuse.org/opensuse-updates/2018-06/msg00094.html · Nota
• https://suse.com/security/cve/CVE-2017-17689 · Nota
• https://lists.opensuse.org/opensuse-updates/2018-05/msg00133.html · Nota
• https://thunderbird.net/en-US/thunderbird/52.9.0/releasenotes · Nota
• https://neopg.io/blog/gpg-signature-spoof · Nota
• https://suse.com/security/cve/CVE-2019-12269 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-12019 · Nota de Segurança
• https://bugzilla.suse.com/1096745 · Nota