CVE-2024-50624
Fixed in a distro release EPSS <1%CVSS 5.9
ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is related to kmail-account-wizard.
Products: kde kmail
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | kmail-account-wizard | 4:20.08.3-1+deb11u1 |
| Debian 12 | kmail-account-wizard | 4:22.12.3-1+deb12u1 |
| Debian 13 | kmail-account-wizard | 4:24.12.0-2 |
| Debian 14 | kmail-account-wizard | 4:24.12.0-2 |
| SUSE Package Hub 15 SP5 | kmail-account-wizard | 23.08.5-bp156.2.3.1 |
| SUSE Package Hub 15 SP6 | kmail-account-wizard | 23.08.5-bp156.2.3.1 |
| Ubuntu Pro 14.04 LTS | kdepim | 4:4.13.3-0ubuntu0.2+esm1 |
| Ubuntu Pro 16.04 LTS | kdepim | 4:15.12.3-0ubuntu1.1+esm1 |
| Ubuntu Pro 18.04 LTS | kmail-account-wizard | 4:17.12.3-0ubuntu1+esm1 |
| Ubuntu Pro 20.04 LTS | kmail-account-wizard | 4:19.12.3-0ubuntu1+esm1 |
| Ubuntu Pro 22.04 LTS | kmail-account-wizard | 4:21.12.3-0ubuntu1+esm1 |
| Ubuntu Pro 24.04 LTS | kmail-account-wizard | 4:23.08.5-0ubuntu3+esm1 |
| openSUSE Leap 15.5 | kmail-account-wizard | 23.08.5-bp156.2.3.1 |
| openSUSE Leap 15.6 | kmail-account-wizard | 23.08.5-bp156.2.3.1 |