CVE-2024-49393

What it actually does

Cryptographic signatures on emails do not cover To and Cc headers, allowing undetected modification of recipient addresses while preserving signature validity.

Why it matters to the business

Sensitive email content can reach unintended recipients, leading to confidentiality breaches that affect compliance, customer trust, and internal operations across email-using organizations.

How an attack unfolds

An attacker positioned on the network intercepts a cryptographically signed message, alters the To or Cc headers to include their own address, and delivers the modified message so the recipient's client accepts the signature as valid.

How to fix it

Upgrade mutt or neomutt to the latest available versions that enforce header inclusion in signatures; apply all vendor patches for Red Hat Enterprise Linux packages; consider client configuration to reject messages with unsigned recipient headers until patches are deployed.

How to confirm the fix worked

Review release notes and package changelogs for header validation fixes; test by sending signed messages with altered headers and confirming the client now flags them as invalid.

Typical attack path

1. Position to intercept outbound or inbound signed email traffic
2. Modify To or Cc header values without invalidating the signature
3. Include attacker-controlled address among recipients
4. Forward or deliver the altered message to original and new recipients

How to detect it

Examine mail server and client logs for unexpected recipient addresses on signed messages; look for signature verification events that succeed despite header mismatches in forensic mail archives.

What your security team should do

• Prioritize patching mutt and neomutt installations within standard change windows given the confidentiality exposure
• Inventory all systems using affected mail clients and track downstream package dependencies
• Configure email clients to warn on or reject messages whose signatures omit recipient headers
• Monitor vendor advisories for Red Hat Enterprise Linux updates addressing this issue