enigmail has published another security fix (2.0.6) that properly prevents displaying unencrypted HTML parts together with encrypted parts. This was already intended in 2.0.5, but didn't work completely. It was still possible to put HTML below an encrypted part, which allows redressing and social engineering attacks. Please bump. Upstream changelog: https://enigmail.net/index.php/en/download/changelog
You cannot expect any bump if you do not even CC the responsible team of this package.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c423e0accff8ecf64926257e1eddc965c606a1a9 commit c423e0accff8ecf64926257e1eddc965c606a1a9 Author: Lars Wendler <polynomial-c@gentoo.org> AuthorDate: 2018-06-01 14:20:03 +0000 Commit: Lars Wendler <polynomial-c@gentoo.org> CommitDate: 2018-06-01 14:20:03 +0000 x11-plugins/enigmail: Security bump to version 2.0.6 Bug: https://bugs.gentoo.org/656790 Package-Manager: Portage-2.3.40, Repoman-2.3.9 x11-plugins/enigmail/Manifest | 1 + x11-plugins/enigmail/enigmail-2.0.6.ebuild | 83 ++++++++++++++++++++++++++++++ 2 files changed, 84 insertions(+)
GLSA Vote: No
