PT-2019-12015 · Kde · Kde Trojita

Published 2019-04-07 · Updated 2022-06-03 · CVE-2019-10734

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions KDE Trojita version 0.7

Description The issue allows an attacker with S/MIME or PGP encrypted emails to craft a multipart email that can hide the encrypted parts using HTML/CSS or ASCII newline characters. When the receiver replies to this email, they may unknowingly leak the plaintext of the encrypted message back to the attacker.

Recommendations For KDE Trojita version 0.7, consider disabling the handling of multipart emails with encrypted sub-parts until a patch is available. Restrict access to the email client's reply function for potentially compromised emails to minimize the risk of exploitation.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2019-10734

MGASA-2022-0214

Affected Products

Kde Trojita

References · 10

• 🔥 https://bugs.kde.org/show_bug.cgi?id=404697 · Exploit
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/UO27BOQW7OIOG56IBQEHPEIS5JYYKDHN · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10734 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0214 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10734 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10734 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10734 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0214.html · Security Note
• https://ubuntu.com/security/CVE-2019-10734 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=30000 · Note