From ${URL}: Overview ======== The POP3 kioslave used by kmail will accept invalid certificates without presenting a dialog to the user due a bug that leads to an inability to display the dialog combined with an error in the way the result is checked. Impact ====== This flaw allows an active attacker to perform MITM attacks against the ioslave which could result in the leakage of sensitive data such as the authentication details and the contents of emails. Workaround ========== None Solution ======== Upgrade to version 4.13.3 or apply the patch at http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=bbae87dc1be3ae063796a582774bd5642cacdd5d&hp=1ccdb43ed3b32a7798eec6d39bb3c83a6e40228f Credits ======= Thanks to Jim Scadden for reporting this issue and writing the initial fix, and to David Faure for reviewing and improving the fix.
@kde team: I figure we might as well wait for 4.13.3 and then just stabilize the lot of that, in place. Unless other KDE team members object, of course.
I bumped 4.12.5-r1 (current stable) and 4.13.2-r1 (likely next stable candidate) with the fix.
(In reply to Maciej Mrozowski from comment #2) > I bumped 4.12.5-r1 (current stable) and 4.13.2-r1 (likely next stable > candidate) with the fix. I don't see anything in tree.
@Agostino Sarubbo *kdelibs-4.12.5-r1 (18 Jun 2014) *kdelibs-4.13.2-r1 (18 Jun 2014) 18 Jun 2014; Maciej Mrozowski (reavertm) +files/kdelibs-4.13.2-CVE-2014-3494.patch, +kdelibs-4.12.5-r1.ebuild, +kdelibs-4.13.2-r1.ebuild, -kdelibs-4.13.2.ebuild: Bug 513726, CVE-2014-3494
(In reply to Frank Krömmelbein from comment #4) > @Agostino Sarubbo > > *kdelibs-4.12.5-r1 (18 Jun 2014) > *kdelibs-4.13.2-r1 (18 Jun 2014) > 18 Jun 2014; Maciej Mrozowski (reavertm) > +files/kdelibs-4.13.2-CVE-2014-3494.patch, +kdelibs-4.12.5-r1.ebuild, > +kdelibs-4.13.2-r1.ebuild, -kdelibs-4.13.2.ebuild: > Bug 513726, CVE-2014-3494 the bug was filed against the wrong package. @kde: is fine to stabilize 4.12.5-r1 ?
Arch teams, please test and stabilise kde-base/kdelibs-4.12.5-r1 Target KEYWORDS="amd64 ppc ppc64 x86". Thanks!
MitM which only discloses information is B4. Will remove 4.13.{0,1} from tree shortly.
(In reply to Chris Reffett from comment #7) > MitM which only discloses information is B4. Will remove 4.13.{0,1} from > tree shortly. Quoting the advisory: > could result in the leakage of sensitive data such as the > authentication details and the contents of emails. Apart the consideration of what the MITM is, I interpret "authentication details" as username/password which is 3 as per https://www.gentoo.org/security/en/vulnerability-policy.xml#doc_chap3.
amd64 stable
x86 stable
ppc/ppc64 stable Added to existng glsa draft. Cleanup, please!
All vulnerable versions removed. Thanks everyone.
This issue was resolved and addressed in GLSA 201406-34 at http://security.gentoo.org/glsa/glsa-201406-34.xml by GLSA coordinator Mikle Kolyada (Zlogene).