Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 4 Oct 2018 13:40:34 +0200
From: Daniel Gruno <>
To:, security <>
Subject: [NOTICE] CVE-2017-5658: Derived information disclosure by Apache Pony

Product: Apache Pony Mail (incubating)
Version affected: Apache Pony Mail 0.7 to 0.9
Vulnerability type: Information Disclosure
Severity: Medium

The statistics generator was found to be returning timestamp data 
without proper authorization checks. This could lead to derived 
information disclosure on private lists about the timing of specific 
email subjects or text bodies, though without disclosing the content 
itself. As this was primarily used as a caching feature for faster 
loading times, the caching was disabled by default to prevent this. 
Users using 0.9 should upgrade to 0.10 to address this issue.

Please see for the 
0.10 release that addresses these issues.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.