PT-2018-8256 · Apache · Apache Pony Mail

Published 2018-10-04 · Updated 2019-01-08 · CVE-2017-5658

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Pony Mail versions 0.7 through 0.9

Description: The statistics generator in Apache Pony Mail was found to be returning timestamp data without proper authorization checks, potentially leading to derived information disclosure on private lists about the timing of specific email subjects or text bodies. This issue was primarily related to a caching feature used for faster loading times, which was disabled by default to prevent this.

Recommendations: For Apache Pony Mail versions 0.7 through 0.9, upgrade to version 0.10 to address this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-5658

Affected Products

Apache Pony Mail

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-5658 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5658 · Vendor Advisory
• https://lists.apache.org/thread.html/6a18cf5690d54231836f277f2b4346b53da3b6b6b08fee4c4ef4977e%40%3Cdev.ponymail.apache.org%3E · Note