CVE-2019-8338

MEDIO 5.9CVE-2019-8338 · Published 16/05/2019 · updated 17/06/2026

In breve

CVE-2019-8338 è una vulnerabilità MEDIO (CVSS 5.9) che riguarda gpg-pgp (gpg-pgp project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.7%, superiore al 77.7% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
gpg-pgp gpg-pgp_project	`≤ 1.0\(9\)`	No fix yet

Description

The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature. Also, it does not verify the validity of the signing key, which allows remote attackers to spoof arbitrary email signatures by crafting a key with a fake user ID (email address) and injecting it into the user's keyring.

References

packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html · Third Party Advisory
seclists.org/fulldisclosure/2019/Apr/38 · Mailing List
Airmail/AirmailPlugIn-Framework · Patch
RUB-NDS/Johnny-You-Are-Fired · Third Party Advisory
RUB-NDS/Johnny-You-Are-Fired · Third Party Advisory
openwall.com/lists/oss-security/2019/04/30/4 · Mailing List

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free