p PatchFirst

CVE-2021-31855

CVE-2021-31855

This page contains facts from public vulnerability sources. Check the original advisory before updating.

KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a remote server (e.g., an IMAP server) causes KMail to upload the decrypted content of the message to the remote server. With a crafted message, a user could be tricked into decrypting an encrypted message and then deleting an attachment attached to this message. If the attacker has access to the messages stored on the email server, then the attacker could read the decrypted content of the encrypted message. This occurs in ViewerPrivate::deleteAttachment in messageviewer/src/viewer/viewer_p.cpp.

CVSS 6.5 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • kf5-messagelib Debian:12

    Affected ranges
    • ECOSYSTEM: < 4:20.08.3-5

    Update to 4:20.08.3-5

  • kdepim4 Ubuntu:18.04:LTS

    Versions
    • 4:4.14.10-7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • kf5-messagelib Ubuntu:Pro:18.04:LTS

    Versions
    • 4:17.04.3-0ubuntu1
    • 4:17.04.3-0ubuntu2
    • 4:17.08.3-0ubuntu1
    • 4:17.08.3-0ubuntu2
    • 4:17.12.2-0ubuntu3
    • 4:17.12.3-0ubuntu2
    • 4:17.12.3-0ubuntu3
    • 4:17.12.3-0ubuntu3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • kf5-messagelib Ubuntu:20.04:LTS

    Versions
    • 4:19.04.3-0ubuntu1
    • 4:19.04.3-0ubuntu2
    • 4:19.12.3-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • kf5-messagelib Ubuntu:22.04:LTS

    Versions
    • 4:21.08.1-0ubuntu1
    • 4:21.08.3-0ubuntu2
    • 4:21.11.80-0ubuntu1
    • 4:21.11.90-0ubuntu1
    • 4:21.12.0-0ubuntu1
    • 4:21.12.1-0ubuntu1
    • 4:21.12.2-0ubuntu1
    • 4:21.12.3-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • kf5-messagelib Ubuntu:24.04:LTS

    Versions
    • 4:23.08.1-0ubuntu1
    • 4:23.08.2-0ubuntu1
    • 4:23.08.3-0ubuntu1
    • 4:23.08.4-0ubuntu1
    • 4:23.08.5-0ubuntu1
    • 4:23.08.5-0ubuntu3
    • 4:23.08.5-0ubuntu4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →