CVE-2018-12019

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

• CWE-347

• http://openwall.com/lists/oss-security/2018/06/13/10Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-Fired
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
• https://www.enigmail.net/index.php/en/download/changelogExploit, Vendor Advisory
• http://openwall.com/lists/oss-security/2018/06/13/10Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-Fired
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
• https://www.enigmail.net/index.php/en/download/changelogExploit, Vendor Advisory

Published

Jun 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12012While updating blacklisting region shared buffered memory re…
• CVE-2018-12013Improper authentication in locked memory region can lead to …
• CVE-2018-12014In all android releases(Android for MSM, Firefox OS for MSM,…
• CVE-2018-12015In Perl through 5.26.2, the Archive::Tar module allows remot…
• CVE-2018-12016libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 …
• CVE-2018-12018The GetBlockHeadersMsg handler in the LES protocol implement…
• CVE-2018-1202Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 …
• CVE-2018-12020mainproc.c in GnuPG before 2.2.8 mishandles the original fil…7.5
• CVE-2018-12021Singularity 2.3.0 through 2.5.1 is affected by an incorrect …
• CVE-2018-12022An issue was discovered in FasterXML jackson-databind prior …7.5
• CVE-2018-12023An issue was discovered in FasterXML jackson-databind prior …
• CVE-2018-12025The transferFrom function of a smart contract implementation…