1925929 - (CVE-2024-11159) remote content in OpenPGP encrypted emails not blocked like it should

Status: RESOLVED FIXED

(MailNews Core :: Security: OpenPGP, defect)

Description

[Magnus Melin [:mkmelin]]

Testing bug 1924058 made me realize we're not hard blocking remote content for OpenPGP encrypted emails the way we're supposed to (only S/MIME), see bug 1411592.

This check is here: https://searchfox.org/comm-central/rev/57782ef9cbf3f0fccb709b33db0bda808101bc02/mailnews/base/src/nsMsgContentPolicy.cpp#321
Another case of confusion due to OpenPGP instead using EnigmailURIs.isEncryptedUri. We should unify this check.

Comment 1

[Kai Engert [:KaiE:]]

Attachment: Bug 1925929 - Forbid viewing remote content in encrypted OpenPGP messages. r=mkmelin

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/f4a450f4d1f5
Forbid viewing remote content in encrypted OpenPGP messages. r=mkmelin

Comment 3

[Kai Engert [:KaiE:]]

Comment on attachment 9433680 [details]
Bug 1925929 - Forbid viewing remote content in encrypted OpenPGP messages. r=mkmelin

[Approval Request Comment]
Regression caused by (bug #): since we offer OpenPGP
User impact if declined: see old CVE-2018-5184 but for OpenPGP
Testing completed (on c-c, etc.):
Risk to taking this patch (and alternatives if risky): Code risk is low. Most of the patch is unifying two parallel tracking services (that were separate for OpenPGP and S/MIME) to a single one, which means all code querying for that status will work regardless of the technology being used. Users might complain they can no longer allow remote content in OpenPGP messages, but we are deliberately disabling that, as we already did in the past for S/MIME messages

Comment 4

[Corey Bryant]

Comment on attachment 9433680 [details]
Bug 1925929 - Forbid viewing remote content in encrypted OpenPGP messages. r=mkmelin

[Triage Comment]
Approved for beta

Comment 5

[Corey Bryant]

CVE-2024-NNNN:
    title: Potential disclosure of plaintext in OpenPGP encrypted message
    impact: high
    reporter: Several reporters
    description: |
      Using remote content in OpenPGP encrypted messages can lead to the
      disclosure of plaintext. This vulnerability affects Thunderbird
      ESR < 128.4.3esr and Thunderbird Release < 132.0.1.
    bugs:
      - url: 1925929

Comment 6

[Kai Engert [:KaiE:]]

Comment on attachment 9433680 [details]
Bug 1925929 - Forbid viewing remote content in encrypted OpenPGP messages. r=mkmelin

Because old CVE bug was sec-high, I think this one should be the same.

Comment 7

[Corey Bryant]

Thunderbird 133.0b3:
https://hg.mozilla.org/releases/comm-beta/rev/ca2621269949

Comment 8

[Corey Bryant]

Comment on attachment 9433680 [details]
Bug 1925929 - Forbid viewing remote content in encrypted OpenPGP messages. r=mkmelin

[Triage Comment]
Approved for release
Approved for esr128

Comment 9

[Daniel Darnell [:dandarnell]]

Thunderbird 128.4.3esr:
https://hg.mozilla.org/releases/comm-esr128/rev/e3bb2f816d5c

Comment 10

[Daniel Darnell [:dandarnell]]

Thunderbird 132.0.1:
https://hg.mozilla.org/releases/comm-release/rev/3e5322772f5c

Comment 11

[Kai Engert [:KaiE:]]

There isn't any secret information in this bug, I'm opening it.