Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 706134 - <x11-plugins/enigmail-2.1.5: Unsigned MIME parts displayed as signed
Summary: <x11-plugins/enigmail-2.1.5: Unsigned MIME parts displayed as signed
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2020-01-23 02:15 UTC by Thomas Deutschmann (RETIRED)
Modified: 2020-03-25 18:18 UTC (History)
1 user (show)

See Also:
Package list:
x11-plugins/enigmail-2.1.5
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Deutschmann (RETIRED) gentoo-dev 2020-01-23 02:15:44 UTC 
From $URL:

Using Content-Type = multipart/alternative, it is possible to trick Enigmail into displaying a valid signature status for a MIME part that is actually not signed.

Such messages have the following structure (or similar):

multipart/alternative
|- multipart/signed
|  |- text/plain
|
|- text/html

Fixed in 2.1.5.

Reproducer:

https://sourceforge.net/p/enigmail/bugs/1044/attachment/Sample%20Message.eml
https://sourceforge.net/p/enigmail/bugs/_discuss/thread/90e18ceedb/e1d4/attachment/Pubkey.asc

References:

https://sourceforge.net/p/enigmail/bugs/1044/
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2020-01-27 21:00:42 UTC 
amd64 & x86 stable
Comment 2 Agostino Sarubbo gentoo-dev 2020-01-30 11:00:57 UTC 
ppc64 stable
Comment 3 Agostino Sarubbo gentoo-dev 2020-01-30 11:05:29 UTC 
ppc stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 4 Larry the Git Cow gentoo-dev 2020-03-25 16:41:35 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3fe9da9fdba4143d89df7f86898af4e12fd779c2

commit 3fe9da9fdba4143d89df7f86898af4e12fd779c2
Author:     Thomas Deutschmann <whissi@gentoo.org>
AuthorDate: 2020-03-25 16:40:49 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2020-03-25 16:41:27 +0000

    x11-plugins/enigmail: security cleanup (bug #706134)
    
    Bug: https://bugs.gentoo.org/706134
    Package-Manager: Portage-2.3.94, Repoman-2.3.21
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 x11-plugins/enigmail/Manifest                      |  3 -
 x11-plugins/enigmail/enigmail-2.0.12-r1.ebuild     | 84 ---------------------
 x11-plugins/enigmail/enigmail-2.0.8-r1.ebuild      | 83 ---------------------
 x11-plugins/enigmail/enigmail-2.1.2-r1.ebuild      | 85 ----------------------
 x11-plugins/enigmail/enigmail-2.1.2.ebuild         | 84 ---------------------
 .../enigmail-2.0.12-enable_seamonkey_support.patch | 20 -----
 .../enigmail/files/enigmail-2.1.2-mimeverify.patch | 44 -----------
 7 files changed, 403 deletions(-)
Comment 5 Thomas Deutschmann (RETIRED) gentoo-dev 2020-03-25 16:42:28 UTC 
GLSA Vote: No!

Repository is clean, all done!
Comment 6 Larry the Git Cow gentoo-dev 2020-03-25 18:18:27 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d1ac19fd9458d60493f13daf7f58ff57856dbb2f

commit d1ac19fd9458d60493f13daf7f58ff57856dbb2f
Author:     Thomas Deutschmann <whissi@gentoo.org>
AuthorDate: 2020-03-25 18:17:17 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2020-03-25 18:18:19 +0000

    Partially revert "x11-plugins/enigmail: security cleanup (bug #706134)"
    
    www-client/seamonkey only supports <=x11-plugins/enigmail-2.1.0.
    
    Bug: https://bugs.gentoo.org/706134
    Package-Manager: Portage-2.3.94, Repoman-2.3.21
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 x11-plugins/enigmail/Manifest                      |  1 +
 x11-plugins/enigmail/enigmail-2.0.12-r1.ebuild     | 84 ++++++++++++++++++++++
 .../enigmail-2.0.12-enable_seamonkey_support.patch | 20 ++++++
 3 files changed, 105 insertions(+)