CVE-2024-49394

What it actually does

The In-Reply-To email header field is excluded from cryptographic signatures on otherwise signed messages, enabling an attacker to reuse an unencrypted signed message while altering context to impersonate the original sender.

Why it matters to the business

Organizations face increased risk of successful email-based impersonation that can undermine trust in signed communications and facilitate social engineering or phishing campaigns.

How an attack unfolds

An attacker obtains a legitimately signed but unencrypted message, reuses its signature on a new message with a crafted In-Reply-To header to make it appear as a reply from the original sender, and delivers it to the target recipient.

How to fix it

Upgrade affected email clients to versions that include the In-Reply-To header within cryptographic signatures; apply the listed fixed package versions where available.

How to confirm the fix worked

Confirm client versions meet or exceed the fixed releases and test that newly signed messages include the In-Reply-To field inside the signature.

Typical attack path

1. Intercept or obtain a signed but unencrypted email
2. Reuse the valid signature while modifying or setting the In-Reply-To header
3. Send the crafted message to the intended recipient as an impersonated reply

How to detect it

Search mail server and client logs for unexpected In-Reply-To values on signed messages or reports of forged replies; correlate with user complaints about impersonated senders.

What your security team should do

• Prioritize patching mutt and neomutt installations to the fixed releases
• Review email signing policies to require encryption alongside signatures where feasible
• Monitor for sudden changes in reply-chain trust or unexpected impersonation reports