Enigmail / Bugs / #983 Signature Spoofing in Enigmail, once again

#983 Signature Spoofing in Enigmail, once again

Status: fixed

Owner: nobody

Labels: None

Found in Version: 2.0.10

Severity: Major

Thunderbird version:

GnuPG version:

Operating System: All

Fixed in version: 2.0.11

Cc: nobody

Updated: 2019-05-16

Created: 2019-04-30

Private: No

A variant of bugs #849 / #709 still works.

1 Attachments

spoof-pgp-email.eml

Jens Müller - 2019-04-30

Severity: Minor --> Major
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Patrick Brunschwig - 2019-05-01

I hate inline-PGP ... :-/

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Patrick Brunschwig - 2019-05-03

Bug fixed: in case of inline-PGP messages, the old approach was to find the node that holds the encrypted (or signed) message part, and replace it with the decrypted or verified message part. If the node is not visible then the operation did succeed but you could not see it - but still the status bar would be green. The new approach is now to always replace the complete HTML document with the decrypted or verified message.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Patrick Brunschwig - 2019-05-16

Fixed in version: 2.1 --> 2.0.11
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Signature Spoofing in Enigmail, once again