In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
References
Link | Resource |
---|---|
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html | Mailing List Third Party Advisory |
https://github.com/roundcube/roundcubemail/issues/6638 | Issue Tracking Exploit Third Party Advisory |
https://github.com/roundcube/roundcubemail/releases/tag/1.3.10 | Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/ |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
07 Nov 2023, 03:02
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
03 May 2022, 14:49
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-319 | |
References | (CONFIRM) https://github.com/roundcube/roundcubemail/releases/tag/1.3.10 - Third Party Advisory | |
References | (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFFMSO5WKEYSGMTZPZFF4ZADUJ57PRN5/ - Mailing List, Third Party Advisory | |
First Time |
Opensuse backports Sle
Opensuse leap Fedoraproject fedora Opensuse Fedoraproject |
|
CPE | cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* |
21 Jul 2021, 11:39
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://github.com/roundcube/roundcubemail/issues/6638 - Issue Tracking, Exploit, Third Party Advisory |
Information
Published : 2019-04-07 15:29
Updated : 2023-12-10 12:59
NVD link : CVE-2019-10740
Mitre link : CVE-2019-10740
CVE.ORG link : CVE-2019-10740
JSON object : View
Products Affected
fedoraproject
- fedora
roundcube
- webmail
opensuse
- leap
- backports_sle
CWE
CWE-319
Cleartext Transmission of Sensitive Information