CVE-2018-20954 - The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys

HIGH

The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys

Published Aug 8, 2019

7.5

HIGH

CVSS 3.0

EPSS 1.15%

The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

Link	Providers	Tags
https://github.com/mailpile/Mailpile/commit/49b64f62ade9ade3dff9337c7bbc1171eab3d59e		x_refsource_MISCPatchThird Party Advisory
https://github.com/mailpile/Mailpile/compare/1.0.0rc3...1.0.0rc4		x_refsource_MISCThird Party Advisory
https://github.com/mailpile/Mailpile/pull/2145		x_refsource_MISCThird Party Advisory

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published Aug 8, 2019

Updated Aug 5, 2024

Reserved Aug 4, 2019

Updated n/a

Status Modified

Modified Jun 17, 2026

Severity n/a

Public date n/a