HighFix available
roundcube — security advisory
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.
- Products
- roundcube
- Affected versions
- Not specified
- Fixed versions
- 1.3.10+dfsg.1-1
- CVEs
- CVE-2018-1000071
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 00:24 UTC · Revision 1
Source evidence
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.
osv:DEBIAN-CVE-2018-1000071
roundcube
Fixed versions: 1.3.10+dfsg.1-1
roundcube
Fixed versions: 1.3.10+dfsg.1-1
roundcube
Fixed versions: 1.3.10+dfsg.1-1
Complete source record
{
"id": "ea6b2aa6b3a433fbb526fa8d0815d53308991884f92285fe2a87893aa9a85db2",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000071",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2018-1000071",
"summary": "roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.",
"evidence": "osv:DEBIAN-CVE-2018-1000071",
"products": [
{
"name": {
"value": "roundcube",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.3.10+dfsg.1-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "roundcube",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.3.10+dfsg.1-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "roundcube",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.3.10+dfsg.1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2018-1000071",
"aliases": [
"DEBIAN-CVE-2018-1000071"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.10+dfsg.1-1"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/debian/roundcube?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000071.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.10+dfsg.1-1"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/debian/roundcube?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000071.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.10+dfsg.1-1"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/debian/roundcube?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000071.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
}
],
"modified": "2026-10-23T18:03:17.371412552Z",
"provider": "osv",
"upstream": [
"CVE-2018-1000071"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2018-1000071"
]
},
"related_cves": [
{
"value": "CVE-2018-1000071",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 421024,
"published_at": "2018-03-13T15:29:00.33+00:00"
}