CVE-2019-9148

Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a valid self-certification. Keys that are obviously invalid are not rejected during import. An attacker that is able to get a victim to import a manipulated key could claim to have signed a message that originates from another person.

• CWE-295

• https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330Release Notes, Third Party Advisory
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.htmlThird Party Advisory
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3Exploit, Third Party Advisory
• https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330Release Notes, Third Party Advisory
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.htmlThird Party Advisory
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3Exploit, Third Party Advisory

Published

Jul 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9142An issue was discovered in b3log Symphony (aka Sym) before v…
• CVE-2019-9143An issue was discovered in Exiv2 0.27. There is infinite rec…
• CVE-2019-9144An issue was discovered in Exiv2 0.27. There is infinite rec…
• CVE-2019-9145An issue was discovered in Hsycms V1.1. There is an XSS vuln…
• CVE-2019-9146Jamf Self Service 10.9.0 allows man-in-the-middle attackers …
• CVE-2019-9147Mailvelope prior to 3.1.0 is vulnerable to a clickjacking at…
• CVE-2019-9149Mailvelope prior to 3.3.0 allows private key operations with…6.5
• CVE-2019-9150Mailvelope prior to 3.3.0 does not require user interaction …
• CVE-2019-9151An issue was discovered in the HDF HDF5 1.10.4 library. Ther…
• CVE-2019-9152An issue was discovered in the HDF HDF5 1.10.4 library. Ther…
• CVE-2019-9153Improper Verification of a Cryptographic Signature in OpenPG…
• CVE-2019-9154Improper Verification of a Cryptographic Signature in OpenPG…