CVE catalog

CVE-2024-50624

KMail Account Wizard vulnerability

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.25% · Oct 25, 2026

ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is related to kmail-account-wizard.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiankmail-account-wizardsid4:26.08.2-2fixed
Debiankmail-account-wizardforky4:26.04.3-2fixed
Debiankmail-account-wizardtrixie4:24.12.3-1+deb13u1fixed
Debiankmail-account-wizardbookworm4:22.12.3-1+deb12u1fixed
Ubuntukmail-account-wizardnoble4:23.08.5-0ubuntu3+esm1fixed
Ubuntuaccountwizardnoble4:23.08.5-0ubuntu3+esm1fixed
Ubuntukmail-account-wizardnoble4:22.12.3-1+deb12u1fixed
Ubuntukmail-account-wizardpro4:23.08.1-0ubuntu1vulnerable
Ubuntukmail-account-wizardpro4:23.08.2-0ubuntu1vulnerable
Ubuntukmail-account-wizardpro4:23.08.3-0ubuntu1vulnerable
Ubuntukmail-account-wizardpro4:23.08.4-0ubuntu1vulnerable
Ubuntukmail-account-wizardpro4:23.08.5-0ubuntu1vulnerable
Ubuntukmail-account-wizardpro4:23.08.5-0ubuntu2vulnerable
Ubuntukmail-account-wizardpro4:23.08.5-0ubuntu3vulnerable
Ubuntukmail-account-wizardpro4:23.08.5-0ubuntu3+esm1fixed
Ubuntukdepimpro4:15.08.2-0ubuntu1vulnerable
Ubuntukdepimpro4:15.12.1-1ubuntu6vulnerable
Ubuntukdepimpro4:15.12.3-0ubuntu1vulnerable
Ubuntukdepimpro4:15.12.3-0ubuntu1.1vulnerable
Ubuntukdepimpro4:15.12.3-0ubuntu1.1+esm1fixed
Ubuntukmail-account-wizardpro4:23.08.1-0ubuntu1vulnerable
Ubuntukmail-account-wizardpro4:23.08.2-0ubuntu1vulnerable
Ubuntukmail-account-wizardpro4:23.08.3-0ubuntu1vulnerable
Ubuntukmail-account-wizardpro4:23.08.4-0ubuntu1vulnerable
Ubuntukmail-account-wizardpro4:23.08.5-0ubuntu1vulnerable
Ubuntukmail-account-wizardpro4:23.08.5-0ubuntu2vulnerable
Ubuntukmail-account-wizardpro4:23.08.5-0ubuntu3vulnerable
Ubuntukmail-account-wizardpro4:23.08.5-0ubuntu3+esm1fixed
Susekmail-account-wizardpackage hub 15 sp523.08.5-bp156.2.3.1fixed
Susekmail-account-wizardpackage hub 15 sp623.08.5-bp156.2.3.1fixed
Opensusekmail-account-wizardleap 15.523.08.5-bp156.2.3.1fixed
Opensusekmail-account-wizardleap 15.623.08.5-bp156.2.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiankmail-account-wizardsourcesid4:24.12.0-2not yet assignedNot reported[1086198]
Debiankmail-account-wizardsourceforky4:24.12.0-2not yet assignedNot reported[1086198]
Debiankmail-account-wizardsourcetrixie4:24.12.0-2not yet assignedNot reported[1086198]
Debiankmail-account-wizardsourcebookworm4:22.12.3-1+deb12u1not yet assignedNot reported[1086198]
Ubuntukmail-account-wizarddebnoble4:23.08.5-0ubuntu3+esm1Not reportedNot reportedNot reported
Ubuntuaccountwizarddebnoble4:23.08.5-0ubuntu3+esm1Not reportedNot reportedNot reported
Ubuntukmail-account-wizarddebnoble4:22.12.3-1+deb12u1Not reportedNot reportedNot reported
Ubuntukmail-account-wizarddebpro4:23.08.5-0ubuntu3+esm1Not reportedUSN-7732-1Not reported
Ubuntukdepimdebpro4:15.12.3-0ubuntu1.1+esm1Not reportedUBUNTU-CVE-2024-50624Not reported
Ubuntukmail-account-wizarddebpro4:23.08.5-0ubuntu3+esm1Not reportedUBUNTU-CVE-2024-50624Not reported
Susekmail-account-wizardrpmpackage hub 15 sp523.08.5-bp156.2.3.1Not reportedOPENSUSE-SU-2024:0353-1Not reported
Susekmail-account-wizardrpmpackage hub 15 sp623.08.5-bp156.2.3.1Not reportedOPENSUSE-SU-2024:0353-1Not reported
Opensusekmail-account-wizardrpmleap 15.523.08.5-bp156.2.3.1Not reportedOPENSUSE-SU-2024:0353-1Not reported
Opensusekmail-account-wizardrpmleap 15.623.08.5-bp156.2.3.1Not reportedOPENSUSE-SU-2024:0353-1Not reported

[Debian bug #1086198]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [accountwizard]Fixed

    Source package: [kmail-account-wizard]

    Details (2)

    • 4:22.12.3-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 4:22.12.3-1+deb12u1

      usn · kmail-account-wizard · debian · bookworm; usn · kmail-account-wizard · debian · 12

    • 4:22.12.3-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 4:22.12.3-1+deb12u1

      usn · kmail-account-wizard · debian · bookworm; usn · kmail-account-wizard · debian · 12

[Debian 13 (Trixie)]

  • [accountwizard]Fixed

    Source package: [kmail-account-wizard]

    Details (2)

    • 4:24.12.3-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 4:24.12.0-2

      usn · kmail-account-wizard · debian · 13

    • 4:24.12.3-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 4:24.12.0-2

      usn · kmail-account-wizard · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]