CVE-2019-10741 Other in n/a
Attackers can forge valid S/MIME or PGP signatures for arbitrary content by exploiting HTML rendering differences in K-9 Mail replies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-10741?
CVE-2019-10741 is a medium-severity vulnerability in n/a, published on 7 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
K-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking, email within (digitally signed) reply messages. The quoted part can contain conditional statements that show completely different text if opened in a different email client. This can be abused by an attacker to obtain valid S/MIME or PGP signatures for arbitrary content to be displayed to a third party. NOTE: the vendor states "We don't plan to take any action because of this."
Weakness: CWE-254
Which versions are affected by CVE-2019-10741?
It affects 1 product.
Products include K-9 Mail Project K-9 Mail.
How do I fix CVE-2019-10741?
No fix has been published for CVE-2019-10741 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-10741 being exploited?
There is no known exploitation of CVE-2019-10741 in the wild and no public exploit code.
Sources
Also known as GHSA-p93q-2cgh-jc3x.