CVE-2018-19205 Information disclosure in n/a
Attackers can exploit mishandled GnuPG integrity warnings in Roundcube to obtain sensitive information from encrypted emails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-19205?
CVE-2018-19205 is a high-severity vulnerability in Roundcube Webmail, published on 12 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.
Weakness: CWE-200
Which versions are affected by CVE-2018-19205?
It affects 1 product.
Products include Roundcube Webmail.
How do I fix CVE-2018-19205?
Upgrade to a fixed version.
Is CVE-2018-19205 being exploited?
There is no known exploitation of CVE-2018-19205 in the wild and no public exploit code.
Other vulnerabilities in Roundcube Webmail
Sources
Also known as DEBIAN-CVE-2018-19205, GHSA-mf49-p66v-cw5m, UBUNTU-CVE-2018-19205.