CVE-2019-10735 Information disclosure in n/a
Attackers can trick users into leaking plaintext of encrypted emails by hiding encrypted parts in crafted multipart messages, requiring user interaction to reply.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-10735?
CVE-2019-10735 is a medium-severity vulnerability in n/a, published on 7 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.
Weakness: CWE-319
Which versions are affected by CVE-2019-10735?
It affects 1 product.
Products include Claws-Mail Mail.
How do I fix CVE-2019-10735?
No fix has been published for CVE-2019-10735 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-10735 being exploited?
There is no known exploitation of CVE-2019-10735 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2019-10735, GHSA-c859-hx66-mxc5, UBUNTU-CVE-2019-10735.