PT-2018-10945 · Enigmail+1 · Enigmail+1

Marcus Brinkmann · Published 2018-06-13 · Updated 2024-06-15 · CVE-2018-12019

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Enigmail versions prior to 2.0.7

Description The issue concerns the signature verification routine, which incorrectly interprets user ids as status/control messages and fails to track the status of multiple signatures. This allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

Recommendations For versions prior to 2.0.7, update to version 2.0.7 or later to resolve the issue.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2018-12019

MGASA-2018-0316

MGASA-2018-0321

MGASA-2018-0354

OPENSUSE-SU-2018_1708-1

OPENSUSE-SU-2024:10736-1

SUSE-SU-2018:2243-1

Affected Products

Enigmail

Suse

References · 43

• 🔥 https://enigmail.net/index.php/en/download/changelog · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:10736-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0321.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-12019 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-12019 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0316 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-12019 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0321 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12019 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0316.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:2243-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-12019 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-18 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12019 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0354.html · Security Note