Enigmail Vulnerability CVE-2019-14664: Multipart Email Attack Exposes Encrypted Messages
Summary
CVE-2019-14664: In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. Affects enigmail versions < 2:2.1.3+ds1-1. Fixed in 2:2.1.3+ds1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Enigmail is an open-source extension for Mozilla Thunderbird that enables users to send and receive encrypted emails using OpenPGP. It provides functionalities such as email encryption, digital signatures, and key management. However, versions prior to 2.1 are vulnerable to a specific attack that can compromise the confidentiality of encrypted messages.
Vulnerability Detail
CVE-2019-14664 is a vulnerability in Enigmail versions below 2.1 that allows an attacker to exploit PGP encrypted emails. By wrapping these emails as sub-parts within a crafted multipart email, the attacker can obscure the encrypted content using HTML/CSS or ASCII newline characters. If the recipient replies to this seemingly benign email, they inadvertently leak the plaintext of the encrypted message back to the attacker. This vulnerability circumvents protections put in place after the EFAIL attacks, posing a significant risk to user privacy and data security.
How To Fix
Minimum fixed version
2:2.1.3+ds1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade enigmailTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid replying to emails that appear to be multipart and contain encrypted content until they have upgraded to the patched version. Additionally, users should be cautious of unexpected emails and verify the sender's identity before responding.
Conclusion
CVE-2019-14664 represents a significant security risk for users of Enigmail versions below 2.1. By understanding the nature of this vulnerability and taking appropriate action to upgrade, users can protect their sensitive information from potential exposure. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for enigmail →
FAQ
CVE-2019-14664 is a vulnerability in Enigmail that allows attackers to exploit encrypted emails, potentially leaking sensitive information.
If you reply to a crafted multipart email containing your encrypted messages, you may inadvertently expose the plaintext of those messages to the attacker.
Enigmail versions below 2.1 are affected by this vulnerability. It is crucial to upgrade to version 2.1.3+ds1-1 or later.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights.
Related vulnerabilities
Recent vulnerabilities recorded for enigmail.
