seahorse plugin in evolution decrypts files in .evolution and leaves them there!

[zanonmark]

Binary package hint: seahorse

There is a serious security hole in the Seahorse plugin for Evolution.

When you click on an attachment and choose the "Decrypt file" option, it decrypts the file under ./.evolution/cache/tmp/evolution-tmp-XXXXXX, without noticing the user.
Once you close Evolution, the "clear" file remains there!

So
1) you did not read the attachment from Evolution (thus making this plugin useless), and
2) the "clear" attachment is still on the disk!

Thanks,

MZ

[Andreas Moog (ampelbein)]

Thank you for your report. Is this still an issue for you?

[zanonmark (info-marcozanon)]

> Thank you for your report. Is this still an issue for you?

yes, it is: just checked now...

thanks :)

Marco

[Andreas Moog (ampelbein)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. I reported this issue upstream, you can track the status and make comments here:

http://bugzilla.gnome.org/show_bug.cgi?id=551235