What is the severity of CVE-2017-5658?

CVE-2017-5658 has a medium severity rating due to its potential to lead to information disclosure.

How do I fix CVE-2017-5658?

To fix CVE-2017-5658, upgrade Apache Pony Mail to version 1.0 or later where this vulnerability is addressed.

What kind of information is exposed by CVE-2017-5658?

CVE-2017-5658 allows unauthorized access to timestamp data related to email subjects and text bodies on private lists.

Which versions of Apache Pony Mail are affected by CVE-2017-5658?

CVE-2017-5658 affects Apache Pony Mail versions from 0.7 to 0.9.

Is user data directly disclosed in CVE-2017-5658?

No, CVE-2017-5658 does not disclose content of emails but exposes timing information related to them.

Vulnerability/
CVE-2017-5658

medium

5.3

CWE

200

4/10/2018

8/1/2019

CVE-2017-5658: Infoleak

First published: Thu Oct 04 2018(Updated: )

The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the content itself. As this was primarily used as a caching feature for faster loading times, the caching was disabled by default to prevent this. Users using 0.9 should upgrade to 0.10 to address this issue.

Credit: security@apache.org

Affected Software	Affected Version	How to fix
Apache Pony Mail	>=0.7<=0.9

Never miss a vulnerability like this again

Reference Links

https://lists.apache.org/thread.html/6a18cf5690d54231836f277f2b4346b53da3b6b6b08fee4c4ef4977e@%3Cdev.ponymail.apache.org%3E

Frequently Asked Questions

What is the severity of CVE-2017-5658?
CVE-2017-5658 has a medium severity rating due to its potential to lead to information disclosure.
How do I fix CVE-2017-5658?
To fix CVE-2017-5658, upgrade Apache Pony Mail to version 1.0 or later where this vulnerability is addressed.
What kind of information is exposed by CVE-2017-5658?
CVE-2017-5658 allows unauthorized access to timestamp data related to email subjects and text bodies on private lists.
Which versions of Apache Pony Mail are affected by CVE-2017-5658?
CVE-2017-5658 affects Apache Pony Mail versions from 0.7 to 0.9.
Is user data directly disclosed in CVE-2017-5658?
No, CVE-2017-5658 does not disclose content of emails but exposes timing information related to them.

collector/nvd-index
agent/severity
agent/references
agent/author
agent/weakness
agent/type
agent/tags
agent/last-modified-date
agent/first-publish-date
agent/description
vendor/apache
canonical/apache pony mail
version/apache pony mail/0.7
version/apache pony mail/0.9

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2017-5658?
CVE-2017-5658 has a medium severity rating due to its potential to lead to information disclosure.
How do I fix CVE-2017-5658?
To fix CVE-2017-5658, upgrade Apache Pony Mail to version 1.0 or later where this vulnerability is addressed.
What kind of information is exposed by CVE-2017-5658?
CVE-2017-5658 allows unauthorized access to timestamp data related to email subjects and text bodies on private lists.
Which versions of Apache Pony Mail are affected by CVE-2017-5658?
CVE-2017-5658 affects Apache Pony Mail versions from 0.7 to 0.9.
Is user data directly disclosed in CVE-2017-5658?
No, CVE-2017-5658 does not disclose content of emails but exposes timing information related to them.