CVE-2017-9604

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-06-13T13:00:00.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-9604", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197", "refsource": "CONFIRM", "url": "https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197"}, {"name": "https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8", "refsource": "CONFIRM", "url": "https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T17:11:02.350Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-9604", "datePublished": "2017-06-13T13:00:00.000Z", "dateReserved": "2017-06-13T00:00:00.000Z", "dateUpdated": "2024-09-17T02:16:34.175Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kde:kmail:*:*:*:*:*:*:*:*", "matchCriteriaId": "AFE05B36-25E9-45C3-B954-23274FF27E23", "versionEndIncluding": "5.5.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:kde:messagelib:*:*:*:*:*:*:*:*", "matchCriteriaId": "EFB5A70C-A555-4661-AD17-FFD7B8401A76", "versionEndIncluding": "5.5.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:kde:kde:17.04:*:*:*:*:*:*:*", "matchCriteriaId": "65A3F3E7-0DD1-44DE-BE29-72C6CEA77327", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network."}, {"lang": "es", "value": "KDE kmail anterior a la 5.5.2 y messagelib anterior a la 5.5.2, como distribuciones en aplicaciones KDE anteriores a la 17.04.2, no asegura que la acci\u00f3n de firma del plugin ocurre durante el uso de la caracter\u00edstica Send Later, lo que permite a un atacante remoto obtener informaci\u00f3n sensible mediante la observaci\u00f3n de la red."}], "id": "CVE-2017-9604", "lastModified": "2026-06-17T01:28:33.570", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-06-13T13:29:00.220", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Patch", "Tool Signature"], "url": "https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Patch", "Tool Signature"], "url": "https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Tool Signature"], "url": "https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Tool Signature"], "url": "https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-311"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kmail: Send Later with Delay bypasses OpenPGP", "id": "1461756", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1461756"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network.", "It was found that KMail's Send Later with Delay function bypassed OpenPGP signing and encryption, causing the message to be sent unsigned and in plain-text. A remote attacker, with access to the user's network traffic, could potentially use this flaw to obtain sensitive information from the plain-text email messages."], "name": "CVE-2017-9604", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Will not fix", "package_name": "kdepim", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kdepim3", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Will not fix", "package_name": "kdepim", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2017-06-13T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-9604\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-9604\nhttps://www.kde.org/info/security/advisory-20170615-1.txt"], "threat_severity": "Low"}

{}