Bug 1677650 (CVE-2018-15587)
| Summary: | CVE-2018-15587 evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | msiddiqu |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | caillon+fedoraproject, lucilanga, mcrha, msiddiqu, rhughes, rschiron, rstrode, sandmann, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-03-31 22:33:39 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1677651, 1686408, 1764563 | ||
| Bug Blocks: | 1677656 | ||
|
Description
msiddiqu
2019-02-15 13:42:45 UTC
Created evolution tracking bugs for this issue: Affects: fedora-28 [bug 1677651] Thanks for a bug report. As the maintainer and an author of the upstream changes: (In reply to msiddiqu from comment #0) > https://gitlab.gnome.org/GNOME/evolution/issues/120 This basically proves that HTML mails are bad. People are using them anyway. When looking into the bug description, the main differences in the provided screenshots are: 1) missing "Security" header, which is the main indication that some content is signed/encrypted in the message; 2) the round corner of the message body is not green; 3) the border of the message body doesn't have a gap between the body and the signature information; 4) clicking the signature button to see the signature information would not work. I agree that some of these are really tiny details and can be overlooked easily. > https://gitlab.gnome.org/GNOME/evolution-data-server/issues/3 I do not want to backport this one to a to-be-in-end-of-life-soon version, because it had some regressions and follow up fixes (because there is no good way (or I'm not aware of any) to synchronize data between two streams provided by gpg). > Upstream Patch: > > https://github.com/clearlinux-pkgs/evolution/commit/ > 70c9346f1a3e4e25344eb7a1f64147dc8dfe9b12 Upstream doesn't use GitHub, the correct upstream commit link is: https://gitlab.gnome.org/GNOME/evolution/commit/9c55a311325f5905d8b8403b96607e46cf343f21 Given a valid OpenPGP signed message signed by person P, it is possible for an attacker to trick Evolution into displaying the "GPG signed" message even if arbitrary text is added to the email, without any signing applied. Thus the victim will see the attacker-controlled message as validly signed by person P. This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:1080 https://access.redhat.com/errata/RHSA-2020:1080 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-15587 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:1600 https://access.redhat.com/errata/RHSA-2020:1600 |