Information Disclosure Vulnerability in KDE Messagelib

CVE-2021-31855

What is CVE-2021-31855?

KDE Messagelib, up to version 5.17.0, has an information disclosure vulnerability that can expose the plaintext content of encrypted messages. When an attachment is deleted from a decrypted encrypted message stored on a remote server, such as an IMAP server, KMail inadvertently uploads the decrypted content back to the server. This risk arises when users are misled into decrypting an encrypted message and subsequently deleting its attachment. Attackers with access to the email server can potentially exploit this flaw to read the plaintext content of these messages.

References