PT-2024-34364 · Kde+3 · Kde Kmail+3

Shushangw · Published 2024-10-27 · Updated 2025-09-03 · CVE-2024-50624

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: KDE Kmail versions prior to 6.2.0

Description: The issue allows man-in-the-middle attackers to trigger the use of an attacker-controlled mail server. This is because cleartext HTTP is used for retrieving configuration from URLs such as 'http://autoconfig.example.com' or 'http://example.com/.well-known/autoconfig'. The problem is related to the kmail-account-wizard component.

Recommendations: For versions prior to 6.2.0, update to version 6.2.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of cleartext HTTP for autoconfig URLs until a patch is applied.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2024-50624

DLA-4196-1

OPENSUSE-SU-2024:0353-1

USN-7729-1

USN-7732-1

Affected Products

Debian

Kde Kmail

Linuxmint

Ubuntu

References · 27

• https://ubuntu.com/security/notices/USN-7732-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10732 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50624 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-50624 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-50624 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-50624 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4196-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-50624 · Security Note
• https://ubuntu.com/security/CVE-2017-17689 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7732-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0353-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-50624 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50624 · Security Note
• https://ubuntu.com/security/notices/USN-7729-1 · Vendor Advisory