Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 25 Apr 2024 18:10:54 +0200
From: Jonas Schäfer <>
To: oss-sec <>
Subject: libksieve (used by kmail/kontact) sent password as username

Hello list,

Managesieve is a protocol to configure the email filtering system Sieve via 
TCP/IP. It is typically authenticated just like IMAP is. The managesieve 
client implementation in KDE (libksieve) had a bug which used the password as 

That exposed the password in plaintext server logs, as usernames are commonly 
logged on failed login attempts.

This bug has existed for several years and made it into multiple Debian 
releases. It has only recently been fixed upstream [1] and even more recently 
been fixed in Debian [2] (stable package updates still pending). As this bug 
has been documented in the internet at various places [3] [4] but I haven't 
seen any mention of it here yet, I thought sharing it here made sense.

As far as I know, no CVE has been allocated for this.

kind regards,

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.