CVE-2018-20954

EUVD-2018-13492
The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
Affected Products (NVD)
VendorProductVersion
mailpilemailpile
0.5.0
mailpilemailpile
0.5.1
mailpilemailpile
0.5.2
mailpilemailpile
1.0.0:rc0
mailpilemailpile
1.0.0:rc1
mailpilemailpile
1.0.0:rc2
mailpilemailpile
1.0.0:rc3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/mailpile/Mailpile/commit/49b64f62ade9ade3dff9337c7bbc1171eab3d59e
https://github.com/mailpile/Mailpile/compare/1.0.0rc3...1.0.0rc4
https://github.com/mailpile/Mailpile/pull/2145
https://github.com/mailpile/Mailpile/commit/49b64f62ade9ade3dff9337c7bbc1171eab3d59e
https://github.com/mailpile/Mailpile/compare/1.0.0rc3...1.0.0rc4
https://github.com/mailpile/Mailpile/pull/2145