Bug 1867605 (CVE-2020-11879)

Summary:	CVE-2020-11879 evolution: attaching local filed/directories to composed email can lead to unintended information disclosure
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caillon+fedoraproject, lucilanga, mbarnes, mcrha, rhughes, rstrode
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	evolution 3.35.91	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-02 17:21:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1867606, 1875166, 1875167
Bug Blocks:	1867609

Description Marian Rehak 2020-08-10 13:13:14 UTC

By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.

Upstream Issue:

https://gitlab.gnome.org/GNOME/evolution/-/issues/784

Comment 1 Marian Rehak 2020-08-10 13:13:33 UTC

Created evolution tracking bugs for this issue:

Affects: fedora-31 [bug 1867606]

Comment 6 Todd Cullum 2020-09-02 23:56:49 UTC

Mitigation:

Either:
1. Do not use mailto links at all
2. Always double-check in the user interface that there are no unwanted attachments before sending emails; especially when the email originates from clicking a mailto link.

Comment 7 Milan Crha 2020-09-03 07:32:36 UTC

I wrote some reasons why not to fix this into [1]. Simply, (as you said) some users see it a problem, some not. The added extra warning may or may not warn the users, make then cautious, but as the [1] says, there are users considering the warning redundant. Similarly as there, I do not have any problem backporting to RHEL-s, but...

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1867606#c2