Bug 1867605 (CVE-2020-11879) - CVE-2020-11879 evolution: attaching local filed/directories to composed email can lead to unintended information disclosure
Summary: CVE-2020-11879 evolution: attaching local filed/directories to composed email...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2020-11879
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1867606 1875166 1875167
Blocks: 1867609
TreeView+ depends on / blocked
 
Reported: 2020-08-10 13:13 UTC by Marian Rehak
Modified: 2024-10-01 16:45 UTC (History)
6 users (show)

Fixed In Version: evolution 3.35.91
Clone Of:
Environment:
Last Closed: 2021-11-02 17:21:43 UTC
Embargoed:


Attachments (Terms of Use)

Description Marian Rehak 2020-08-10 13:13:14 UTC
By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.

Upstream Issue:

https://gitlab.gnome.org/GNOME/evolution/-/issues/784

Comment 1 Marian Rehak 2020-08-10 13:13:33 UTC
Created evolution tracking bugs for this issue:

Affects: fedora-31 [bug 1867606]

Comment 6 Todd Cullum 2020-09-02 23:56:49 UTC
Mitigation:

Either:
1. Do not use mailto links at all
2. Always double-check in the user interface that there are no unwanted attachments before sending emails; especially when the email originates from clicking a mailto link.

Comment 7 Milan Crha 2020-09-03 07:32:36 UTC
I wrote some reasons why not to fix this into [1]. Simply, (as you said) some users see it a problem, some not. The added extra warning may or may not warn the users, make then cautious, but as the [1] says, there are users considering the warning redundant. Similarly as there, I do not have any problem backporting to RHEL-s, but...

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1867606#c2


Note You need to log in before you can comment on or make changes to this bug.