Medium severity4.3NVD Advisory· Published Jul 9, 2019· Updated Jun 17, 2026
CVE-2019-9148
CVE-2019-9148
Description
Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a valid self-certification. Keys that are obviously invalid are not rejected during import. An attacker that is able to get a victim to import a manipulated key could claim to have signed a message that originates from another person.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Mailvelope/Mailvelopedescription
- Range: <3.3.0
Patches
Vulnerability mechanics
References
3- www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdfnvdExploitThird Party Advisory
- github.com/mailvelope/mailvelope/blob/master/Changelog.mdnvdRelease NotesThird Party Advisory
- www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.htmlnvdThird Party Advisory
News mentions
0No linked articles in our index yet.