Bugzilla – Bug 1179091
VUL-0: CVE-2020-27748: xdg-utils: local file inclusion vulnerability
Last modified: 2022-11-01 08:05:07 UTC
CVE-2020-27748 A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird. Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=1613425 Upstream commit: https://gitlab.freedesktop.org/Mic92/xdg-utils/-/commit/1f199813e0eb0246f63b54e9e154970e609575af References: https://bugzilla.redhat.com/show_bug.cgi?id=1899769 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27748
Tracked as affected SLE12,SLE15 and SLE15-SP2
Upstream hasn't merged the fix yet, some clients such as evolution have implemented a warning dialog for such cases, notably Thunderbird hasn't though, for clients that support adding an attachments via the command line this is likely a better solution. I believe Debian uses the feature in some cases for collecting bug reports etc so before implementing this fix by removing the feature in xdg-utils we should tripple check that it won't break anything.
(In reply to Simon Lees from comment #2) > Upstream hasn't merged the fix yet, some clients such as evolution have > implemented a warning dialog for such cases, notably Thunderbird hasn't > though, for clients that support adding an attachments via the command line > this is likely a better solution. > > I believe Debian uses the feature in some cases for collecting bug reports > etc so before implementing this fix by removing the feature in xdg-utils we > should tripple check that it won't break anything. Simon, what is the status of this bug upstream? I can see that the upstream PR is closed, so I guess no fix it planned to be developed
It seems the original patch that removed functionality was rejected https://gitlab.freedesktop.org/xdg/xdg-utils/-/merge_requests/28 and the original upstream issue is still open https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177
New PR craeted, still open: https://gitlab.freedesktop.org/xdg/xdg-utils/-/merge_requests/58