CVE-2019-8338

The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature. Also, it does not verify the validity of the signing key, which allows remote attackers to spoof arbitrary email signatures by crafting a key with a fake user ID (email address) and injecting it into the user's keyring.

• CWE-347

• http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
• https://github.com/Airmail/AirmailPlugIn-Framework/commits/masterPatch, Third Party Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-FiredThird Party Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdfThird Party Advisory
• https://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
• https://github.com/Airmail/AirmailPlugIn-Framework/commits/masterPatch, Third Party Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-FiredThird Party Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdfThird Party Advisory
• https://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory

Published

May 16, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-8325An issue was discovered in RubyGems 2.6 and later through 3.…7.5
• CVE-2019-8331In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is pos…6.1
• CVE-2019-8334An issue was discovered in SchoolCMS 2.3.1. There is an XSS …
• CVE-2019-8335An issue was discovered in SchoolCMS 2.3.1. There is an XSS …
• CVE-2019-8336HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 …
• CVE-2019-8337In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its d…
• CVE-2019-8339An issue was discovered in Falco through 0.14.0. A missing i…
• CVE-2019-8341An issue was discovered in Jinja2 2.10. The from_string func…9.8
• CVE-2019-8342A Local Privilege Escalation in libqcocoa.dylib in Foxit Rea…
• CVE-2019-8343In Netwide Assembler (NASM) 2.14.02, there is a use-after-fr…
• CVE-2019-8345The Help feature in the ES File Explorer File Manager applic…
• CVE-2019-8346In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an…