Received-SPF: pass (google.com: domain of oss-security-return-30099-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Sender: Salvatore Bonaccorso <salvatore.bonaccorso@gmail.com>
Date: Tue, 30 Apr 2024 09:41:31 +0200
From: Salvatore Bonaccorso <carnil@debian.org>
To: oss-security@lists.openwall.com
Message-ID: <ZjCgq5y_tKM0oXW7@eldamar.lan>
References: <5222127.EKZ5pzy0G1@sinistra.local>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <5222127.EKZ5pzy0G1@sinistra.local>
Subject: Re: [oss-security] libksieve (used by kmail/kontact) sent password
 as username

On Thu, Apr 25, 2024 at 06:10:54PM +0200, Jonas Sch?fer wrote:
> Hello list,
> 
> Managesieve is a protocol to configure the email filtering system Sieve via 
> TCP/IP. It is typically authenticated just like IMAP is. The managesieve 
> client implementation in KDE (libksieve) had a bug which used the password as 
> username.
> 
> That exposed the password in plaintext server logs, as usernames are commonly 
> logged on failed login attempts.
> 
> This bug has existed for several years and made it into multiple Debian 
> releases. It has only recently been fixed upstream [1] and even more recently 
> been fixed in Debian [2] (stable package updates still pending). As this bug 
> has been documented in the internet at various places [3] [4] but I haven't 
> seen any mention of it here yet, I thought sharing it here made sense.
> 
> As far as I know, no CVE has been allocated for this.

FTR, https://www.cve.org/CVERecord?id=CVE-2023-52723 was assigned for
this issue.

Regards,
Salvatore