In KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
References
Link | Resource |
---|---|
https://bugs.kde.org/show_bug.cgi?id=404697 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2019-04-07T14:34:33
Updated: 2019-04-07T14:34:33
Reserved: 2019-04-03T00:00:00
Link: CVE-2019-10734
JSON object: View
NVD Information
Status : Analyzed
Published: 2019-04-07T15:29:00.293
Modified: 2021-07-21T11:39:23.747
Link: CVE-2019-10734
JSON object: View
Redhat Information
No data.
CWE