claws-mail: CVE-2019-10735

Debian Bug report logs - #926705
claws-mail: CVE-2019-10735

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Sylvain Beucler <beuc@beuc.net>

To: submit@bugs.debian.org

Subject: claws-mail: CVE-2019-10735

Date: Tue, 9 Apr 2019 13:24:21 +0200

Package: claws-mail
Version: 3.17.3-2
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for claws-mail.

CVE-2019-10735[0]:
| In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP
| encrypted emails can wrap them as sub-parts within a crafted multipart
| email. The encrypted part(s) can further be hidden using HTML/CSS or
| ASCII newline characters. This modified multipart email can be re-sent
| by the attacker to the intended receiver. If the receiver replies to
| this (benign looking) email, they unknowingly leak the plaintext of
| the encrypted message part(s) back to the attacker.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-10735
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10735
https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4159

Cheers!
Sylvain

Message #12 received at 926705@bugs.debian.org (full text, mbox, reply):

From: Ricardo Mones <mones@debian.org>

To: Sylvain Beucler <beuc@beuc.net>, 926705@bugs.debian.org

Subject: Re: Bug#926705: claws-mail: CVE-2019-10735

Date: Tue, 9 Apr 2019 16:03:44 +0200

[Message part 1 (text/plain, inline)]

control: forwarded -1 https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4159
control: tags -1 confirmed upstream

On Tue, Apr 09, 2019 at 01:24:21PM +0200, Sylvain Beucler wrote:
> Package: claws-mail
> Version: 3.17.3-2
> X-Debbugs-CC: team@security.debian.org
> Severity: important
> Tags: security
> 
> Hi,
> 
> The following vulnerability was published for claws-mail.
> 
> CVE-2019-10735[0]:
> | In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP
> | encrypted emails can wrap them as sub-parts within a crafted multipart
> | email. The encrypted part(s) can further be hidden using HTML/CSS or
> | ASCII newline characters. This modified multipart email can be re-sent
> | by the attacker to the intended receiver. If the receiver replies to
> | this (benign looking) email, they unknowingly leak the plaintext of
> | the encrypted message part(s) back to the attacker.
> 
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2019-10735
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10735
> https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4159
> 
> Cheers!
> Sylvain

Alright, thanks.
-- 
  Ricardo Mones 
  ~
  Physics is like sex: sure, it may give some practical results, but 
  that's not why we do it.                            Richard Feynman

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.