https://bugs.kde.org/show_bug.cgi?id=525253
Bug ID: 525253
Summary: Forward as attachment can break a good valid signature
Classification: Applications
Product: kmail2
Version First 6.7.3
Reported In:
Platform: openSUSE
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
DESCRIPTION
If you save a signed message (and the signature validates) as a file, the saved
file will still contain a message that validates.
Doesn't matter if you drag'n'drop the file to a folder on disk or use Ctrl+S
(Save as).
If you forward the message as attachment (or drag it to the message editor to
add as attachment), it apparently gets reencoded or otherwiese changed. The
message doesnt not necessarily validate anymore.
This should not happen to signed messages, these should be added as attachment
'as-is' to preserve the signature-message-integrity.
STEPS TO REPRODUCE
1. Have a message with a valid signature
2. Draft a email to forward it as attachment (either via dragndrop the the
maileditor or via forward as attachment)
3. Signature of the attached message does not validate anymore
OBSERVED RESULT
Signature of the attached message does not validate anymore (neither in the
message editor attachment preview) not when saved as draft in the messageview
of the draft nor when actually sent)
EXPECTED RESULT
Message gets added unchanged (binary the same data as the save message as file)
Signature Validation of the attached message will stay as it was, ensuring a
valid signed message will be transferred as such
SOFTWARE/OS VERSIONS
Operating System: openSUSE Tumbleweed 20260712
KDE Plasma Version: 6.7.2
KDE Frameworks Version: 6.27.0
Qt Version: 6.11.1
Kernel Version: 7.1.2-1-vanilla (64-bit)
Graphics Platform: Wayland
ADDITIONAL INFORMATION
Unfortunately, my the message I encountered this bug with is one I cannot
share, so I cannot provide it as a test/demonstration file. But I can share
some information about the message:
The message I encountered this bug with was S/MIME signed
I received the message from another party which used MS365 to send it.
The Content-Type/Encoding headers:
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
micalg=2.16.840.1.101.3.4.2.1;
boundary="----=_NextPart_000_014C_01DD3C5B.17116790"
MIME-Version: 1.0
The Part Body headers (so you can infer the message structure and encoding)
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_014D_01DD3C5B.17116790"
------=_NextPart_001_014D_01DD3C5B.17116790
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
....
------=_NextPart_001_014D_01DD3C5B.17116790
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
....
------=_NextPart_001_014D_01DD3C5B.17116790--
------=_NextPart_000_014C_01DD3C5B.17116790
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
--
You are receiving this mail because:
You are watching all bug changes.
