VDB
GHSA-fc79-j7vw-6xjg
GHSA-fc79-j7vw-6xjg
PUBLISHED
CVSS 7.5 HIGH
Record from GitHub Advisory Database · Published May 14, 2022
The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.
Risk scores
CVSS 3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Timeline
- May 14, 2022 CVE Published
- Apr 29, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-fc79-j7vw-6xjg
vulnetix vdb fixes GHSA-fc79-j7vw-6xjgOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-fc79-j7vw-6xjg/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf url
- http://openwall.com/lists/oss-security/2018/06/13/10 url
- https://github.com/RUB-NDS/Johnny-You-Are-Fired url
- https://www.enigmail.net/index.php/en/download/changelog url
- http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html url
- http://www.openwall.com/lists/oss-security/2019/04/30/4 url
- https://nvd.nist.gov/vuln/detail/CVE-2018-12019 advisory
- http://seclists.org/fulldisclosure/2019/Apr/38 url