Summary
It was discovered that KMail Account Wizard used HTTP rather than HTTPS
when retrieving certain email server configurations. An attacker could
possibly use this issue to cause email clients to use an
attacker-controlled email server.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | kmail-account-wizard | 4:17.12.3-0ubuntu1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | kmail-account-wizard | 4:19.12.3-0ubuntu1+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | kmail-account-wizard | 4:21.12.3-0ubuntu1+esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | kmail-account-wizard | 4:23.08.5-0ubuntu3+esm1 |
Vulnerabilities 1
-
Medium 5.9
ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled …
References
-
report
https://ubuntu.com/security/CVE-2024-50624