2024-04-25 16:21:10

by Jonas Schäfer

[permalink] [raw]
Subject: [oss-security] libksieve (used by kmail/kontact) sent password as username

Hello list,

Managesieve is a protocol to configure the email filtering system Sieve via
TCP/IP. It is typically authenticated just like IMAP is. The managesieve
client implementation in KDE (libksieve) had a bug which used the password as
username.

That exposed the password in plaintext server logs, as usernames are commonly
logged on failed login attempts.

This bug has existed for several years and made it into multiple Debian
releases. It has only recently been fixed upstream [1] and even more recently
been fixed in Debian [2] (stable package updates still pending). As this bug
has been documented in the internet at various places [3] [4] but I haven't
seen any mention of it here yet, I thought sharing it here made sense.

As far as I know, no CVE has been allocated for this.

kind regards,
Jonas

[1]: https://invent.kde.org/pim/libksieve/-/commit/
6b460ba93ac4ac503ba039d0b788ac7595120db1
[2]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069163
[3]: https://bugs.kde.org/show_bug.cgi?id=437858
[4]: https://www.reddit.com/r/kde/comments/151xq9r/comment/jsavmds/

Attachments:
signature.asc (849.00 B)
This is a digitally signed message part.

2024-04-30 07:41:59

by Salvatore Bonaccorso

[permalink] [raw]
Subject: Re: [oss-security] libksieve (used by kmail/kontact) sent password as username

On Thu, Apr 25, 2024 at 06:10:54PM +0200, Jonas Sch?fer wrote:
> Hello list,
>
> Managesieve is a protocol to configure the email filtering system Sieve via
> TCP/IP. It is typically authenticated just like IMAP is. The managesieve
> client implementation in KDE (libksieve) had a bug which used the password as
> username.
>
> That exposed the password in plaintext server logs, as usernames are commonly
> logged on failed login attempts.
>
> This bug has existed for several years and made it into multiple Debian
> releases. It has only recently been fixed upstream [1] and even more recently
> been fixed in Debian [2] (stable package updates still pending). As this bug
> has been documented in the internet at various places [3] [4] but I haven't
> seen any mention of it here yet, I thought sharing it here made sense.
>
> As far as I know, no CVE has been allocated for this.

FTR, https://www.cve.org/CVERecord?id=CVE-2023-52723 was assigned for
this issue.

Regards,
Salvatore