← Back

Gpg Pgp Project

gpg-pgp_project

1 CVE • 1 product

Products (1)

Click to collapse
Toggle
Gpg Pgp
gpg-pgp
1 CVE

CVEs (1)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-8338
1Gpg Pgp Project
1Gpg Pgp
Nov 21, 2024
May 16, 2019
N/A· v4
5.9 MEDIUM· v3
4.3 MEDIUM· v2
The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by cra...Show more
The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature. Also, it does not verify the validity of the signing key, which allows remote attackers to spoof arbitrary email signatures by crafting a key with a fake user ID (email address) and injecting it into the user's keyring.Show less