Bulwark Webmail S/MIME Signature Verification Vulnerability Allowing Trusting of Untrusted Certificates

A vulnerability exists in Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server, in versions prior to 1.4.11. The issue arises because S/MIME signature verification did not properly validate the certificate trust chain, allowing emails signed with self-signed or untrusted certificates to be incorrectly displayed as having valid signatures. This vulnerability is particularly concerning for users who relied on the S/MIME signature verification feature.

Impact

The vulnerability allows S/MIME signature verification to accept self-signed certificates, leading to incorrect validation of email signatures.

Remediation

Users are advised to upgrade to Bulwark Webmail version 1.4.11 or later, where this vulnerability has been fixed by enabling proper certificate chain validation. There are no workarounds available.