group.of.nepali.translators team mailing list archive
-
group.of.nepali.translators team
-
Mailing list archive
-
Message #22514
[Bug 1698180] Re: [CVE] Send Later with Delay bypasses OpenPGP
This bug was fixed in the package kdepim - 4:15.12.3-0ubuntu1.1
---------------
kdepim (4:15.12.3-0ubuntu1.1) xenial-security; urgency=medium
* SECURITY UPDATE: Send Later with Delay bypasses OpenPGP (LP: #1698180):
- fix-CVE-2017-9604.patch
- CVE-2017-9604
-- Simon Quigley <tsimonq2@xxxxxxxxxx> Sun, 25 Mar 2018 07:38:25 -0500
** Changed in: kdepim (Ubuntu Xenial)
Status: Confirmed => Fix Released
--
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1698180
Title:
[CVE] Send Later with Delay bypasses OpenPGP
Status in kdepim package in Ubuntu:
Invalid
Status in kf5-messagelib package in Ubuntu:
Fix Released
Status in kmail package in Ubuntu:
Fix Released
Status in kdepim source package in Trusty:
Fix Released
Status in kdepim source package in Xenial:
Fix Released
Bug description:
KDE Project Security Advisory
=============================
Title: KMail: Send Later with Delay bypasses OpenPGP
Risk Rating: Medium
CVE: CVE-2017-9604
Versions: kmail, messagelib < 5.5.2
Date: 15 June 2017
Overview
========
KMail’s Send Later with Delay function bypasses OpenPGP signing and
encryption, causing the message to be sent unsigned and in plain-text.
Solution
========
Update to kmail, messagelib >= 5.5.2 (Released as part of KDE Applications 17.04.2)
Or apply the following patches:
kmail: https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8
messagelib: https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197
Credits
=======
Thanks to Daniel Aleksandersen for the report and to Laurent Montel for the fix.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/kdepim/+bug/1698180/+subscriptions