CVE-2018-12019

HIGH

Enigmail < 2.0.7 - Cryptographic Signature Spoofing via Crafted Primary User IDs

Title source: llm
STIX 2.1

Description

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

References (7)

Core 7
Core References
Mailing List, Third Party Advisory x_refsource_misc
http://openwall.com/lists/oss-security/2018/06/13/10
Exploit, Vendor Advisory x_refsource_misc
https://www.enigmail.net/index.php/en/download/changelog
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/04/30/4
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2019/Apr/38
Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html

Scores

CVSS v3 7.5
EPSS 0.0214
EPSS Percentile 79.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-347
Status published
Products (1)
enigmail/enigmail < 2.0.7
Published Jun 13, 2018
Tracked Since Feb 18, 2026