Description
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://sourceforge.net/p/enigmail/bugs/709/ ↗
- https://lists.debian.org/debian-security-announce/2017/msg00333.html ↗
- https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html ↗
- https://www.debian.org/security/2017/dsa-4070 ↗
- http://www.openwall.com/lists/oss-security/2019/04/30/4 ↗
- http://seclists.org/fulldisclosure/2019/Apr/38 ↗
- http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html ↗
- https://github.com/RUB-NDS/Johnny-You-Are-Fired ↗
- https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf ↗