CVE-2018-20954

The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 43%
VendorProductVersion
mailpilemailpile
0.5.0
mailpilemailpile
0.5.1
mailpilemailpile
0.5.2
mailpilemailpile
1.0.0:rc0
mailpilemailpile
1.0.0:rc1
mailpilemailpile
1.0.0:rc2
mailpilemailpile
1.0.0:rc3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/mailpile/Mailpile/commit/49b64f62ade9ade3dff9337c7bbc1171eab3d59e
https://github.com/mailpile/Mailpile/compare/1.0.0rc3...1.0.0rc4
https://github.com/mailpile/Mailpile/pull/2145
https://github.com/mailpile/Mailpile/commit/49b64f62ade9ade3dff9337c7bbc1171eab3d59e
https://github.com/mailpile/Mailpile/compare/1.0.0rc3...1.0.0rc4
https://github.com/mailpile/Mailpile/pull/2145