File 0001-Fix-CVE-2021-31855.patch of Package messagelib

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-Fix-CVE-2021-31855.patch of Package messagelib (Revision 1ee82b364c26a50d240ddeb86db352b1)

Currently displaying revision 1ee82b364c26a50d240ddeb86db352b1 , Show latest

From 3b5b171e91ce78b966c98b1292a1bcbc8d984799 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <kloecker@kde.org>
Date: Thu, 29 Apr 2021 22:13:38 +0200
Subject: [PATCH] Fix CVE-2021-31855

Deleting an attachment of a decrypted encrypted message stored on a remote server
(e.g. an IMAP server) causes KMail to upload the decrypted content of the message
to the remote server. This is not easily noticeable by the user because KMail does
not display the decrypted content.
---
 messageviewer/src/viewer/viewer_p.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/messageviewer/src/viewer/viewer_p.cpp b/messageviewer/src/viewer/viewer_p.cpp
index 4591ab1592..c06e148902 100644
--- a/messageviewer/src/viewer/viewer_p.cpp
+++ b/messageviewer/src/viewer/viewer_p.cpp
@@ -396,7 +396,7 @@ bool ViewerPrivate::deleteAttachment(KMime::Content *node, bool showWarning)
 
     KMime::Message *modifiedMessage = mNodeHelper->messageWithExtraContent(mMessage.data());
     mMimePartTree->mimePartModel()->setRoot(modifiedMessage);
-    mMessageItem.setPayloadFromData(modifiedMessage->encodedContent());
+    mMessageItem.setPayloadFromData(mMessage->encodedContent());
     auto job = new Akonadi::ItemModifyJob(mMessageItem, mSession);
     job->disableRevisionCheck();
     connect(job, &KJob::result, this, &ViewerPrivate::itemModifiedResult);
-- 
2.31.1

Places

File 0001-Fix-CVE-2021-31855.patch of Package messagelib (Revision 1ee82b364c26a50d240ddeb86db352b1)

Places