oss-sec mailing list archives
libksieve (used by kmail/kontact) sent password as username
From: Jonas Schäfer <j.wielicki () sotecware net>
Date: Thu, 25 Apr 2024 18:10:54 +0200
Hello list, Managesieve is a protocol to configure the email filtering system Sieve via TCP/IP. It is typically authenticated just like IMAP is. The managesieve client implementation in KDE (libksieve) had a bug which used the password as username. That exposed the password in plaintext server logs, as usernames are commonly logged on failed login attempts. This bug has existed for several years and made it into multiple Debian releases. It has only recently been fixed upstream [1] and even more recently been fixed in Debian [2] (stable package updates still pending). As this bug has been documented in the internet at various places [3] [4] but I haven't seen any mention of it here yet, I thought sharing it here made sense. As far as I know, no CVE has been allocated for this. kind regards, Jonas [1]: https://invent.kde.org/pim/libksieve/-/commit/ 6b460ba93ac4ac503ba039d0b788ac7595120db1 [2]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069163 [3]: https://bugs.kde.org/show_bug.cgi?id=437858 [4]: https://www.reddit.com/r/kde/comments/151xq9r/comment/jsavmds/
Attachment:
signature.asc
Description: This is a digitally signed message part.
Current thread:
- libksieve (used by kmail/kontact) sent password as username Jonas Schäfer (Apr 25)
- Re: libksieve (used by kmail/kontact) sent password as username Salvatore Bonaccorso (Apr 30)