oss-sec mailing list archives
CVE Request: evolution mail client GPG key selection issue
From: Yves-Alexis Perez <corsac () debian org>
Date: Sun, 21 Jul 2013 22:02:16 +0200
Hi, an issue with security impact was recently fixed in Evolution. More details can be found on the Red Hat bug report at https://bugzilla.redhat.com/show_bug.cgi?id=973728 but it basically boils down to a wrong selection when choosing the the keyid for a destination email address. Basically, when you have multiple keys in the keyrings, with overlapping email addresses (like foo () example com and foobar () example com), you can end up (silently) encrypting to the wrong recipient. It actually happened to me when forwarding embargoed security issues so it can happen in real life. Now the wrong recipient would need to actually obtain a copy of the sent mail (since it's sent to the correct recipient, not the wrong one), but I still think it warrants a CVE. Quick fix was to use the documented format for email searches in GnuPG (using <> around email addresses) but a more complete fix for explicit key selection should appear some time in the future. Regards, -- Yves-Alexis
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- CVE Request: evolution mail client GPG key selection issue Yves-Alexis Perez (Jul 21)
- Re: CVE Request: evolution mail client GPG key selection issue Kurt Seifried (Jul 25)
- Re: CVE Request: evolution mail client GPG key selection issue Yves-Alexis Perez (Jul 25)
- Re: CVE Request: evolution mail client GPG key selection issue Daniel Kahn Gillmor (Jul 25)
- Re: CVE Request: evolution mail client GPG key selection issue Kurt Seifried (Jul 25)
- Re: CVE Request: evolution mail client GPG key selection issue Daniel Kahn Gillmor (Jul 25)
- Re: CVE Request: evolution mail client GPG key selection issue Kurt Seifried (Jul 25)
- Re: CVE Request: evolution mail client GPG key selection issue Daniel Kahn Gillmor (Jul 25)
- Re: CVE Request: evolution mail client GPG key selection issue Kurt Seifried (Jul 25)