CVE-2019-8338 Security feature bypass in n/a
The Airmail GPG-PGP Plugin fails to verify signature status and key validity, allowing attackers to spoof email signatures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-8338?
CVE-2019-8338 is a medium-severity vulnerability in n/a, published on 16 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature. Also, it does not verify the validity of the signing key, which allows remote attackers to spoof arbitrary email signatures by crafting a key with a fake user ID (email address) and injecting it into the user's keyring.
Weakness: CWE-347
Which versions are affected by CVE-2019-8338?
It affects 1 product.
Products include Gpg-Pgp Project Gpg-Pgp.
How do I fix CVE-2019-8338?
No fix has been published for CVE-2019-8338 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-8338 being exploited?
There is no known exploitation of CVE-2019-8338 in the wild and no public exploit code.
Sources
Also known as GHSA-8m6f-q6pm-9pmm.