PT-2019-18974 · Airmail · Airmail Gpg-Pgp Plugin

Marcus Brinkmann · Publicado 2019-05-16 · Atualizado 2019-05-21 · CVE-2019-8338

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Airmail GPG-PGP Plugin versions 1.0 (9) and earlier

Description The issue concerns the signature verification routine, which fails to verify the status of the signature and the validity of the signing key. This allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature or by creating a key with a fake user ID (email address) and injecting it into the user's keyring.

Recommendations For Airmail GPG-PGP Plugin versions 1.0 (9) and earlier, consider disabling the signature verification feature until a patch is available to prevent spoofing of email signatures. Restrict access to the keyring to minimize the risk of malicious key injection. Avoid using the plugin for verifying email signatures until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2019-8338

Produtos afetados

Airmail Gpg-Pgp Plugin

Referências · 8

• https://github.com/Airmail/AirmailPlugIn-Framework/commits/master · Correção
• https://github.com/RUB-NDS/Johnny-You-Are-Fired · Nota
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf · Nota
• http://seclists.org/fulldisclosure/2019/Apr/38 · Nota
• http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html · Nota
• https://openwall.com/lists/oss-security/2019/04/30/4 · Nota
• https://osv.dev/vulnerability/CVE-2019-8338 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8338 · Nota de Segurança