CVE-2019-10734

In KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.

References

https://bugs.kde.org/show_bug.cgi?id=404697

Affected packages

Git / github.com/jktjkt/trojita

Affected ranges

Type

GIT

Repo

https://github.com/jktjkt/trojita

Events

Introduced

065d527c63e8e4a3ca0df73994f848b52e14ed58

Last affected

065d527c63e8e4a3ca0df73994f848b52e14ed58

Database specific

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:trojita_project:trojita:0.7:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.7"
        },
        {
            "last_affected": "0.7"
        }
    ]
}

Affected versions

0.*

0.7

v0.*

v0.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10734.json"