Re: CVE Request: KDE Pim

[Vincent Danen <vdanen () redhat com>]

* [2012-07-17 10:18:06 +0200] laurent Montel wrote:

> Le lundi 16 juillet 2012 11:47:59 Vincent Danen a écrit :
> > * [2012-07-13 10:41:33 -0600] Kurt Seifried wrote:
> > >On 07/13/2012 06:25 AM, Marc Deslauriers wrote:
> > >> Hello,
> > >>
> > >> Could a CVE please be assigned to the following issue:
> > >>
> > >> Javascript and external images were being loaded while rendering
> > >> HTML email in kmail. The downloaded Javascript was then being
> > >> interpreted.
> > >>
> > >> See:
> > >>
> > >> https://projects.kde.org/projects/kde/kdepim/repository/revisions/dbb2f72
> > >> f4745e00f53031965a9c10b2d6862bd54>>
> > >>  https://bugs.launchpad.net/ubuntu/+source/kdepim/+bug/1022690
> > >>
> > >> Thanks,
> > >>
> > >> Marc.
> > >
> > >This seems like a security hardening issue to me, but I'm not a KDE
> > >person so did kdepim advertise itself as not executing JavaScript/etc?
> >
> > Doing some digging, it looks like this was introduced in kdepim 4.4, and
> > would not affect earlier versions.  Can anyone confirm this?
>
> No it was added in 4.6 or 4.7 when we ported to akonadi2
> In 4.4 it didn't use *WebKit*
>
> and it didn't use same code :
> it used DOM::
>
> '  try {
>   // Create a DOM Document from the HTML source
>   DOM::HTMLDocument doc;
>   doc.open();
>   doc.write( htmlSource );
>   doc.close();
>
>   mIsQuotedLine = false;
>   mIsFirstTextNodeInLine = true;
>   processNode( doc.documentElement() );
>   return doc.toString().string();
> }
> '
>
> So for me it's just kmail > 4.6 (we released an old 4.6-akonadi)
>
> not necessary to try to fix in 4.4
>
> I CC David if he has more infos.
>
> I hope that it helps.
>
> Security problem is that we allows to use javascript.
> In 4.4 we don't have it.

Thanks for the info, Laurent (and thanks for the testcase, David).

I'm still unsure whether or not a CVE is required, as per Kurt's
comments about whether or not kmail was ever advertised as not
executing javascript.

I think because, at one time, it did not execute javascript, and now it
does (which is clearly bad for a mail client to do), it probably does
require a CVE name but before assigning one and getting negative
feedback, I'd like to make sure that assigning one is indeed
appropriate.

--
Vincent Danen / Red Hat Security Response Team