After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 551235 - seahorse plugin in evolution decrypts files in .evolution and leaves them there!
seahorse plugin in evolution decrypts files in .evolution and leaves them there!
Status: RESOLVED DUPLICATE of bug 414235
Product: seahorse-plugins
Classification: Applications
Component: General
2.23.x
Other All
: Normal major
: 2.24
Assigned To: seahorse-plugins-maint
seahorse-plugins-maint
Depends on:
Blocks:
 
 
Reported: 2008-09-07 15:14 UTC by Andreas Moog
Modified: 2008-09-07 22:00 UTC
See Also:
GNOME target: ---
GNOME version: 2.23/2.24


Description Andreas Moog 2008-09-07 15:14:55 UTC 
Please describe the problem:
There is a serious security hole in the Seahorse plugin for Evolution.

When you click on an attachment and choose the "Decrypt file" option, it decrypts the file under ./.evolution/cache/tmp/evolution-tmp-XXXXXX, without noticing the user.
Once you close Evolution, the "clear" file remains there!

So
1) you did not read the attachment from Evolution (thus making this plugin useless), and
2) the "clear" attachment is still on the disk!

Thanks,



Steps to reproduce:


Actual results:


Expected results:


Does this happen every time?
Yes

Other information:
This bug was reported on Launchpad:
https://bugs.edge.launchpad.net/ubuntu/+source/seahorse/+bug/176454
Comment 1 Adam Schreiber 2008-09-07 21:05:19 UTC 
Could you check how the evolution plugin is decrypting files, if it's calling seahorse-tool it's a bug for us, if not it's an evolution bug as we didn't write that plugin.
Comment 2 Andreas Moog 2008-09-07 21:32:29 UTC 
I've run evolution with

strace evolution 2>&1 | grep seahorse

and when i open the attachment there is

open("/usr/share/applications/seahorse-pgp-encrypted.desktop", O_RDONLY|O_LARGEFILE) = 45

in which seahorse-tool --decrypt will be exceuted. So I guess its a seahorse issue.
Comment 3 Adam Schreiber 2008-09-07 22:00:37 UTC 
Ok, thanks.  It's a dup then.Thanks for the bug report. This particular bug has already been reported into our bug tracking system, but please feel free to report any further bugs you find.


*** This bug has been marked as a duplicate of 414235 ***