[CVE] Send Later with Delay bypasses OpenPGP

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

Luca Beltrame from opensuse & KDE kidly pointed out the following patches that have been applied and backported there for their currently shipped versions. Some may either apply here, or be adaptable if not.

For PIM 4.14

https://build.opensuse.org/package/view_file/home:luca_b:422pimfix/kdepim4.openSUSE_Leap_42.2_Update/use-plugin-for-sendlater.patch?expand=1

https://build.opensuse.org/package/view_file/home:luca_b:422pimfix/kdepim4.openSUSE_Leap_42.2_Update/also-encrypt-when-sending-later-cve-2017-9604.patch

For 16.08 which we do not have, but may be in whole or part applicable to PIM 16.12 or 16.04 packages.

https://build.opensuse.org/package/view_file/home:luca_b:422pimfix/kdepim.openSUSE_Leap_42.2_Update/use-plugin-for-sendlater.patch?expand=1

https://build.opensuse.org/package/view_file/home:luca_b:422pimfix/messagelib.openSUSE_Leap_42.2_Update/also-encrypt-when-sending-later-cve-2017-9604.patch?expand=1

kdepim no longer exists in Artful, and fixes are in artful-proposed for kmail and kf5-messagelib (it's part of the new upstream release).

I have uploaded these fixes (for Xenial and Trusty) to a fresh test PPA of mine with all architectures switched on and only the security repo enabled. I then tested both in VMs of each release, and they work as intended. It also fixes the security issue.

Security Team, feel free to copy my packages to your PPA:
https://launchpad.net/~tsimonq2/+archive/ubuntu/security-test-builds/+sourcepub/8878568/+listing-archive-extra
https://launchpad.net/~tsimonq2/+archive/ubuntu/security-test-builds/+sourcepub/8878391/+listing-archive-extra

The diffs for each are on that page if you would like to do it manually.

Please sponsor each to go into Ubuntu.

Thanks.

This bug was fixed in the package kdepim - 4:15.12.3-0ubuntu1.1

---------------
kdepim (4:15.12.3-0ubuntu1.1) xenial-security; urgency=medium

  * SECURITY UPDATE: Send Later with Delay bypasses OpenPGP (LP: #1698180):
    - fix-CVE-2017-9604.patch
    - CVE-2017-9604

 -- Simon Quigley <email address hidden> Sun, 25 Mar 2018 07:38:25 -0500

This bug was fixed in the package kdepim - 4:4.13.3-0ubuntu0.2

---------------
kdepim (4:4.13.3-0ubuntu0.2) trusty-security; urgency=medium

  * SECURITY UPDATE: Send Later with Delay bypasses OpenPGP (LP: #1698180):
    - fix-CVE-2017-9604.patch
    - CVE-2017-9604

 -- Simon Quigley <email address hidden> Sun, 25 Mar 2018 11:02:11 -0500