Rainloop 1.16 (current) has an unpatched security bug

[necrevistonnezr]

As per https://thehackernews.com/2022/04/unpatched-bug-in-rainloop-webmail-could.html

An unpatched high-severity security flaw has been disclosed in the open-source RainLoop web-based email client that could be weaponized to siphon emails from victims' inboxes.

"The code vulnerability [...] can be easily exploited by an attacker by sending a malicious email to a victim that uses RainLoop as a mail client," SonarSource security researcher Simon Scannell said in a report published this week.

"When the email is viewed by the victim, the attacker gains full control over the session of the victim and can steal any of their emails, including those that contain highly sensitive information such as passwords, documents, and password reset links."

On Yunohost they recommend switching to Snappymail (already in the appstore): https://forum.yunohost.org/t/security-rainloop-suffers-a-security-bug/19579

[girish]

@necrevistonnezr thanks for reporting. Making a new package with the patch at https://blog.sonarsource.com/rainloop-emails-at-risk-due-to-code-flaw

[girish]

I have pushed a new package with the patch.