CVE-2019-8338

Vulnerability

The Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature nor the validity of the signing key during signature verification [1][2]. This flaw allows attackers to bypass authenticity checks on signed emails.

Exploitation

An attacker can craft a signed email with an invalid signature or create a key with a fake user ID and inject it into the victim's keyring [1][2]. The attacker then sends an email that appears properly signed to the victim. No prior authentication or special network position is required; the attacker only needs to send an email.

Impact

Successful exploitation allows the attacker to spoof arbitrary email signatures, leading to false authentication of emails. This can enable phishing attacks or impersonation of trusted senders, compromising the integrity and authenticity of email communications.

Mitigation

As of the disclosure in April 2019, no official patch was available for the affected versions [4]. Users should monitor the Airmail plugin repository for updates and upgrade to a patched version if released [4]. If no fix is provided, consider disabling the GPG-PGP plugin or using an alternative secure email client.