Security update for enigmail

Announcement ID: SUSE-SU-2018:2243-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2018-12019 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
  • CVE-2018-12019 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • CVE-2018-12020 ( SUSE ): 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  • CVE-2018-12020 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • CVE-2018-12020 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products:
  • SUSE Linux Enterprise Desktop 15
  • SUSE Linux Enterprise Server 15
  • SUSE Linux Enterprise Server for SAP Applications 15
  • SUSE Linux Enterprise Workstation Extension 15

An update that solves two vulnerabilities and has one security fix can now be installed.

Description:

This update for enigmail to 2.0.7 fixes the following issues:

These security issues were fixed:

  • CVE-2018-12020: Mitigation against GnuPG signature spoofing: Email signatures could be spoofed via an embedded "--filename" parameter in OpenPGP literal data packets. This update prevents this issue from being exploited if GnuPG was not updated (boo#1096745)
  • CVE-2018-12019: The signature verification routine interpreted User IDs as status/control messages and did not correctly keep track of the status of multiple signatures. This allowed remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids (boo#1097525)
  • Disallow plaintext (literal packets) outside of encrpyted packets
  • Replies to a partially encrypted message may have revealed protected information - no longer display PGP/MIME message part followed by unencrypted data (bsc#1094781)
  • Fix signature Spoofing via Inline-PGP in HTML Mails

These non-security issues were fixed:

  • Fix filter actions forgetting selected mail folder names
  • Fix compatibility issue with Thunderbird 60b7

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Workstation Extension 15
    zypper in -t patch SUSE-SLE-Product-WE-15-2018-1514=1

Package List:

  • SUSE Linux Enterprise Workstation Extension 15 (x86_64)
    • enigmail-2.0.7-3.7.2

References: