{"action":"created","issue":{"url":"https://api.github.com/repos/roundcube/roundcubemail/issues/6289","repository_url":"https://api.github.com/repos/roundcube/roundcubemail","labels_url":"https://api.github.com/repos/roundcube/roundcubemail/issues/6289/labels{/name}","comments_url":"https://api.github.com/repos/roundcube/roundcubemail/issues/6289/comments","events_url":"https://api.github.com/repos/roundcube/roundcubemail/issues/6289/events","html_url":"https://github.com/roundcube/roundcubemail/issues/6289","id":322719553,"number":6289,"title":"EFAIL vulnerability","user":{"login":"nurupo","id":1855294,"avatar_url":"https://avatars1.githubusercontent.com/u/1855294?v=4","gravatar_id":"","url":"https://api.github.com/users/nurupo","html_url":"https://github.com/nurupo","followers_url":"https://api.github.com/users/nurupo/followers","following_url":"https://api.github.com/users/nurupo/following{/other_user}","gists_url":"https://api.github.com/users/nurupo/gists{/gist_id}","starred_url":"https://api.github.com/users/nurupo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nurupo/subscriptions","organizations_url":"https://api.github.com/users/nurupo/orgs","repos_url":"https://api.github.com/users/nurupo/repos","events_url":"https://api.github.com/users/nurupo/events{/privacy}","received_events_url":"https://api.github.com/users/nurupo/received_events","type":"User","site_admin":false},"labels":[{"id":344588259,"url":"https://api.github.com/repos/roundcube/roundcubemail/labels/C:%20Plugins","name":"C: Plugins","color":"bfd4f2","default":false},{"id":344588235,"url":"https://api.github.com/repos/roundcube/roundcubemail/labels/C:%20Security","name":"C: Security","color":"bfd4f2","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2018-05-14T08:33:50Z","updated_at":"2018-05-19T06:43:25Z","closed_at":null,"author_association":"NONE","body":"It looks like a critical vulnerability related to decryption of PGP emails with S/MIME will be announced in 22 hours and 30 minutes [[1]](https://www.eff.org/deeplinks/2018/05/attention-pgp-users-new-vulnerabilities-require-you-take-action-now), [[2]](https://arstechnica.com/information-technology/2018/05/critical-pgp-and-smime-bugs-can-reveal-encrypted-e-mails-uninstall-now/). Since Roundcube does support PGP email decryption, it has Enigma PGP plugin, it might be wise to follow the vulnerability to see if any changes are required in Roundube's code.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/roundcube/roundcubemail/issues/comments/390384174","html_url":"https://github.com/roundcube/roundcubemail/issues/6289#issuecomment-390384174","issue_url":"https://api.github.com/repos/roundcube/roundcubemail/issues/6289","id":390384174,"user":{"login":"alecpl","id":546788,"avatar_url":"https://avatars2.githubusercontent.com/u/546788?v=4","gravatar_id":"","url":"https://api.github.com/users/alecpl","html_url":"https://github.com/alecpl","followers_url":"https://api.github.com/users/alecpl/followers","following_url":"https://api.github.com/users/alecpl/following{/other_user}","gists_url":"https://api.github.com/users/alecpl/gists{/gist_id}","starred_url":"https://api.github.com/users/alecpl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alecpl/subscriptions","organizations_url":"https://api.github.com/users/alecpl/orgs","repos_url":"https://api.github.com/users/alecpl/repos","events_url":"https://api.github.com/users/alecpl/events{/privacy}","received_events_url":"https://api.github.com/users/alecpl/received_events","type":"User","site_admin":false},"created_at":"2018-05-19T06:43:25Z","updated_at":"2018-05-19T06:43:25Z","author_association":"MEMBER","body":"From what I understand now, there's two cases\r\n1. MDC protected message - if protection check fails the message is not decrypted (proper DECRYPTION_FAILED status).\r\n2. No MDC in the message (true for very old messages) - GnuPG decrypts the message with only a warning.\r\n\r\nSo, what we need to do is to make the warning an exception and handle it as it was DECRYPTION_FAILED. Enigmail did exactly the same. However, their users started complaining immediately quite a lot about that. So, I guess we'd need to implement a way to display the message anyway, e.g. \"The message does not contain modification detection code. Decrypting it might be insecure. [Decrypt]\"."}}
{"actor":{"display_login":"alecpl"}}