CVE-2018-20954 (published 2019-08-08T21:15Z)

The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/mailpile/Mailpile
commit_details: repo_url: https://github.com/mailpile/Mailpile
author: Jack Dodds
author_date: 2018-09-21 12:17:11-04:00
msg: First working (but rough) version to omit revoked and disabled keys from
Add account-Security and Privacy-Encryption pulldown.
repository: repo_url: https://github.com/mailpile/Mailpile
repo_name: mailpile/Mailpile
description: A free & open modern, fast email client with user-friendly encryption and privacy features
repo_language: Python
owner: mailpile
file_changes: filename: gpgi.py
change_type: ModificationType.MODIFY
diff: @@ -810,6 +810,9 @@ class GnuPG:
         # state when listing secret keys; it seems internally only the
         # public key is disabled. This makes it hard for us to reason about
         # which keys can actually be used, so we compensate...
+        # *** FIXME JackDca 2018-09-21 - Above behaviour not seen in 2.1.18 if
+        # --with-colons is used (but true for human-readable output) so this
+        # code could be deleted.
         list_keys = ["--fingerprint"]
         for fprint in set(secret_keys):
             list_keys += ["--list-keys", fprint]

programming_language: Python
filename: crypto_gnupg.py
change_type: ModificationType.MODIFY
diff: @@ -387,11 +387,24 @@ class GPGKeyListSecret(Command):
     """List Secret GPG Keys"""
     ORDER = ('', 0)
     SYNOPSIS = (None, 'crypto/gpg/keylist/secret',
-                'crypto/gpg/keylist/secret', '<address>')
+                                    'crypto/gpg/keylist/secret', '[<check>]')
     HTTP_CALLABLE = ('GET', )
+    HTTP_QUERY_VARS = {'check': 'True to omit disabled, expired, revoked keys'}
 
     def command(self):
-        res = self._gnupg().list_secret_keys()
+        args = list(self.args)
+        if len(args) > 0:
+            check = args[0]
+        else:
+            check = self.data.get('check', '')
+        check = 'True' in check
+        
+        all = self._gnupg().list_secret_keys()
+        if check:
+            res = {fprint : all[fprint] for fprint in all
+                if not (all[fprint]['revoked'] or all[fprint]['disabled'])}
+        else:
+            res = all
         return self._success("Searched for secret keys", res)
 
 

programming_language: Python
filename: account-form.html
change_type: ModificationType.MODIFY
diff: @@ -714,7 +714,7 @@
                 name="security-pgp-key">
           <option value="!CREATE:RSA2048">{{_("Create a new 2048 bit RSA key")}}</option>
           <option value="!CREATE:RSA3072" class="fpa-pgp-key-default">{{_("Create a new 3072 bit RSA key")}}</option>
-        {%- set pgp_keys = mailpile('crypto/gpg/keylist/secret').result %}
+        {%- set pgp_keys = mailpile('crypto/gpg/keylist/secret','True').result %}
         {%- for fingerprint in pgp_keys -%}
           {%- set key = pgp_keys[fingerprint] -%}
           {%- for uid in key.uids %}

programming_language: JavaScript