CVE-2018-1000071

Name of the Vulnerable Software and Affected Versions: roundcube versions 1.3.4 and earlier

Description: The issue concerns a problem with insecure permissions in the enigma plugin, which can lead to the exfiltration of the gpg private key. This can be exploited through network connectivity.

Recommendations: For roundcube versions 1.3.4 and earlier, consider disabling the enigma plugin as a temporary workaround until a patch is available. Restrict access to the enigma plugin to minimize the risk of exploitation. Avoid using the enigma plugin via network connectivity until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.