Description
In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a password value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | libkf5ksieve | 4:22.12.3-1+deb12u1 | — |
| Debian 10 | libkf5ksieve | 4:18.08.3-2+deb10u1 | DLA-3809-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | libkf5ksieve | No fix yet | — |
| Ubuntu 20.04 LTS | libkf5ksieve | No fix yet | — |
| Ubuntu 18.04 LTS | libkf5ksieve | No fix yet | — |
Advisories 1
- DLA-3809-1 libkf5ksieve - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://invent.kde.org/pim/libksieve/-/commit/6b460ba93ac4ac503ba039d0b788ac7595120db1
- https://invent.kde.org/pim/libksieve/-/tags/v23.03.80
- https://www.openwall.com/lists/oss-security/2024/04/25/1
- [oss-security] 20240430 Re: libksieve (used by kmail/kontact) sent password as username mailing-list
- [debian-lts-announce] 20240505 [SECURITY] [DLA 3809-1] libkf5ksieve security update mailing-list