PT-2019-18974 · Airmail · Airmail Gpg-Pgp Plugin

Marcus Brinkmann · Published 2019-05-16 · Updated 2019-05-21 · CVE-2019-8338

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Airmail GPG-PGP Plugin versions 1.0 (9) and earlier

Description The issue concerns the signature verification routine, which fails to verify the status of the signature and the validity of the signing key. This allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature or by creating a key with a fake user ID (email address) and injecting it into the user's keyring.

Recommendations For Airmail GPG-PGP Plugin versions 1.0 (9) and earlier, consider disabling the signature verification feature until a patch is available to prevent spoofing of email signatures. Restrict access to the keyring to minimize the risk of malicious key injection. Avoid using the plugin for verifying email signatures until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2019-8338

Affected Products

Airmail Gpg-Pgp Plugin

References · 8

• https://github.com/Airmail/AirmailPlugIn-Framework/commits/master · Patch
• https://osv.dev/vulnerability/CVE-2019-8338 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8338 · Security Note
• https://github.com/RUB-NDS/Johnny-You-Are-Fired · Note
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf · Note
• http://seclists.org/fulldisclosure/2019/Apr/38 · Note
• http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html · Note
• https://openwall.com/lists/oss-security/2019/04/30/4 · Note