Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

IMAP password exposed via error dialog box #5472

Closed
gahr opened this issue Oct 12, 2016 · 2 comments
Closed

IMAP password exposed via error dialog box #5472

gahr opened this issue Oct 12, 2016 · 2 comments
Labels
bug C: IMAP C: Security
Milestone
1.2.3

Comments

@gahr
Copy link

gahr commented Oct 12, 2016

Error conditions at IMAP server side (such as failure to response because of extremely high machine load) could expose a user's password when the LOGIN command fails and the "Unable to send command: $request") string is displayed.

https://github.com/roundcube/roundcubemail/blob/master/program/lib/Roundcube/rcube_imap_generic.php#L2031
@alecpl
Copy link
Member

alecpl commented Oct 12, 2016

Yup, it should be anonymized as we do for debug logging. Or we should use only the command name (e.g. UID FETCH, SEARCH, etc.) instead of the full command with arguments.

@alecpl alecpl added this to the 1.2.3 milestone Oct 12, 2016
alecpl added a commit that referenced this issue Oct 15, 2016
@alecpl
Fix bug where IMAP password could be exposed via error message (#5472)
cf9f0d8
alecpl added a commit that referenced this issue Oct 15, 2016
@alecpl
Fix bug where IMAP password could be exposed via error message (#5472)
d867ea9
@alecpl
Copy link
Member

alecpl commented Oct 15, 2016

Fixed.

@alecpl alecpl closed this as completed Oct 15, 2016
ZiBiS added a commit to ZiBiS/roundcubemail that referenced this issue Oct 17, 2016
@ZiBiS
Merge remote-tracking branch 'upstream/master'
548c13f 
* upstream/master:
  Fix bug where it wasn't possible to store more that 2MB objects in memcache/apc (roundcube#5452) Added memcache_max_allowed_packet and apc_max_allowed_packet settings
  assword: Added possibility to nicely handle password epiration from other plugins (roundcube#5468)
  Fix bug where IMAP password could be exposed via error message (roundcube#5472)
  Fix bug where deleting folders with subfolders could fail in some cases (roundcube#5466)
  Support HTML input to rcube_text_editor.replace() (roundcube#5456)
  Set smtp options in sample config as they are required now
  Optimize image size
  Bump database version
  Better icon and CSS styles for PGP-related attachments (roundcube#5301 and roundcube#5279)
  Add icons for pgp-keys and php-encrypted attachments (roundcube#5301 and roundcube#5279)
  Update changelog
  Fix flickering of header topline in min-mode (roundcube#5426)
  Do not show inline images of unsupported mimetype (roundcube#5463)
  SQL, upgrade: increase session table ip field size for IPv6 addresses
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug C: IMAP C: Security
Projects
None yet
Milestone
1.2.3
Development

No branches or pull requests
2 participants
@alecpl @gahr