CVE-2024-49395

What it actually does

PGP encryption does not use the --hidden-recipient mode, allowing inference of Bcc email header field from the recipients info in the encrypted message.

Why it matters to the business

Organizations relying on the affected software may experience unintended exposure of private email recipient details, increasing risk of privacy violations and compliance issues; the high number of downstream dependents amplifies potential widespread impact despite low exploit likelihood.

How an attack unfolds

An attacker intercepts an encrypted email sent via the vulnerable client and examines the PGP recipient list to deduce Bcc addresses that should have remained hidden.

How to fix it

Upgrade python-django (Ubuntu:14.04:LTS) to version 1.6.1-2ubuntu0.11; apply the fix immediately given the published date and ecosystem prevalence.

How to confirm the fix worked

Confirm the installed version matches or exceeds 1.6.1-2ubuntu0.11 and test by sending emails with Bcc recipients to verify no leakage in encryption metadata.

Typical attack path

1. Send or intercept encrypted email using affected client
2. Inspect PGP encryption metadata for recipient list
3. Infer and extract Bcc addresses from visible recipients

How to detect it

Review email logs and encrypted message headers for anomalies in recipient metadata; check client configuration files for PGP options and audit historical encrypted emails for Bcc inference patterns.

What your security team should do

• Prioritize upgrade of all instances to the fixed version 1.6.1-2ubuntu0.11
• Monitor for any email encryption configuration changes post-update
• Review email privacy policies to account for potential historical exposures