CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-17847
https://notcve.org/view.php?id=CVE-2017-17847
An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format. Se ha descubierto un problema en versiones anteriores a la 1.9.9 de Enigmail. Se puede dar una suplantación de firma debido a que la interfaz de usuario no distingue correctamente entre una firma adjunta y una firma que aplica a todo el mensaje. • https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html https://lists.debian.org/debian-security-announce/2017/msg00333.html https://sourceforge.net/p/enigmail/bugs/709 https://www.debian.org/security/2017/dsa-4070 https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-17844
https://notcve.org/view.php?id=CVE-2017-17844
An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 "replay" issue. Se ha descubierto un problema en versiones anteriores a la 1.9.9 de Enigmail. Un atacante remoto puede obtener contenido en texto claro enviando un bloque de datos cifrados (que no puede descifrar directamente) a una víctima y confiando en que la víctima descifre automáticamente el bloque y luego lo devuelva al atacante como texto citado. Esto también se conoce como problema "replay" TBE-01-005. • https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html https://lists.debian.org/debian-security-announce/2017/msg00333.html https://www.debian.org/security/2017/dsa-4070 https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0CVE-2017-17848 – Johnny You Are Fired
https://notcve.org/view.php?id=CVE-2017-17848
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text. Se ha descubierto un problema en versiones anteriores a la 1.9.9 de Enigmail. En una variante de CVE-2017-17847, se puede dar la suplantación de firma para mensajes multipart/related debido a que se puede hacer referencia a una parte del mensaje firmado con un id de contenido cid: URI, pero no se puede mostrar. • http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html http://seclists.org/fulldisclosure/2019/Apr/38 http://www.openwall.com/lists/oss-security/2019/04/30/4 https://github.com/RUB-NDS/Johnny-You-Are-Fired https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html https://lists.debian.org/debian-security-announce/2017/msg00333.html https://sourceforge.net/p/enigmail/bu • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-17845
https://notcve.org/view.php?id=CVE-2017-17845
An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-01-001. Se ha descubierto un problema en versiones anteriores a la 1.9.9 de Enigmail. Ocurre una generación incorrecta de secretos aleatorios debido a que pretty Easy privacy (pEp) utiliza Math.Random(). Esto también se conoce como TBE-01-001. • https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html https://lists.debian.org/debian-security-announce/2017/msg00333.html https://www.debian.org/security/2017/dsa-4070 https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html • CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-17846
https://notcve.org/view.php?id=CVE-2017-17846
An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long strings, aka TBE-01-003. Se ha descubierto un problema en versiones anteriores a la 1.9.9 de Enigmail. Se explotan expresiones regulares para provocar una denegación de servicio (DoS) debido a los intentos de combinar cadenas largas de manera arbitraria. Esto también se conoce como TBE-01-003. • https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html https://lists.debian.org/debian-security-announce/2017/msg00333.html https://www.debian.org/security/2017/dsa-4070 https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html • CWE-20: Improper Input Validation •