From 3b5b171e91ce78b966c98b1292a1bcbc8d984799 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= Date: Thu, 29 Apr 2021 22:13:38 +0200 Subject: [PATCH] Fix CVE-2021-31855 Deleting an attachment of a decrypted encrypted message stored on a remote server (e.g. an IMAP server) causes KMail to upload the decrypted content of the message to the remote server. This is not easily noticeable by the user because KMail does not display the decrypted content. --- messageviewer/src/viewer/viewer_p.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/messageviewer/src/viewer/viewer_p.cpp b/messageviewer/src/viewer/viewer_p.cpp index 4591ab159..c06e14890 100644 --- a/messageviewer/src/viewer/viewer_p.cpp +++ b/messageviewer/src/viewer/viewer_p.cpp @@ -396,7 +396,7 @@ bool ViewerPrivate::deleteAttachment(KMime::Content *node, bool showWarning) KMime::Message *modifiedMessage = mNodeHelper->messageWithExtraContent(mMessage.data()); mMimePartTree->mimePartModel()->setRoot(modifiedMessage); - mMessageItem.setPayloadFromData(modifiedMessage->encodedContent()); + mMessageItem.setPayloadFromData(mMessage->encodedContent()); auto job = new Akonadi::ItemModifyJob(mMessageItem, mSession); job->disableRevisionCheck(); connect(job, &KJob::result, this, &ViewerPrivate::itemModifiedResult);