[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 21 Jul 2013 22:02:16 +0200
From: Yves-Alexis Perez <corsac@...ian.org>
To: oss-security@...ts.openwall.com
Subject: CVE Request: evolution mail client GPG key selection issue
Hi,
an issue with security impact was recently fixed in Evolution. More
details can be found on the Red Hat bug report at
https://bugzilla.redhat.com/show_bug.cgi?id=973728 but it basically
boils down to a wrong selection when choosing the the keyid for a
destination email address.
Basically, when you have multiple keys in the keyrings, with overlapping
email addresses (like foo@...mple.com and foobar@...mple.com), you can
end up (silently) encrypting to the wrong recipient.
It actually happened to me when forwarding embargoed security issues so
it can happen in real life. Now the wrong recipient would need to
actually obtain a copy of the sent mail (since it's sent to the correct
recipient, not the wrong one), but I still think it warrants a CVE.
Quick fix was to use the documented format for email searches in GnuPG
(using <> around email addresses) but a more complete fix for explicit
key selection should appear some time in the future.
Regards,
--
Yves-Alexis
Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
