Vulnerability Description
The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Enigmail | Enigmail | < 2.0.7 |
Related Weaknesses (CWE)
References
- http://openwall.com/lists/oss-security/2018/06/13/10Mailing ListThird Party Advisory
- http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2019/Apr/38Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2019/04/30/4Mailing ListThird Party Advisory
- https://github.com/RUB-NDS/Johnny-You-Are-Fired
- https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.p
- https://www.enigmail.net/index.php/en/download/changelogExploitVendor Advisory
- http://openwall.com/lists/oss-security/2018/06/13/10Mailing ListThird Party Advisory
- http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2019/Apr/38Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2019/04/30/4Mailing ListThird Party Advisory
- https://github.com/RUB-NDS/Johnny-You-Are-Fired
- https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.p
- https://www.enigmail.net/index.php/en/download/changelogExploitVendor Advisory
FAQ
What is CVE-2018-12019?
CVE-2018-12019 is a vulnerability with a CVSS score of 7.5 (HIGH). The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote a...
How severe is CVE-2018-12019?
CVE-2018-12019 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-12019?
Check the references section above for vendor advisories and patch information. Affected products include: Enigmail Enigmail.