CVE-2017-17689
Debian Security Advisory 4244-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
La especificación S/MIME permite un ataque malleability-gadget Cipher Block Chaining (CBC) que puede conducir indirectamente a la exfiltración en texto plano. Esto también se conoce como EFAIL.
An update that fixes two vulnerabilities is now available. This update for enigmail to version 2.0.4 fixes multiple issues. CFB gadget attacks allowed to exfiltrate plaintext out of encrypted emails. Enigmail now fails on GnuPG integrity check warnings for old Algorithms CBC gadget attacks allows to exfiltrate plaintext out of encrypted emails This update also includes new and updated functionality. Enigmail will chose between S/MIME or OpenPGP depending on whether the keys for all recipients are available for the respective standard subject, following the Memory Hole standard for protected Email Headers intervals.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-12-15 CVE Reserved
- 2018-05-16 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-07-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/104165 | Third Party Advisory | |
| https://news.ycombinator.com/item?id=17066419 | Issue Tracking | |
| https://pastebin.com/gNCc8aYm | Third Party Advisory | |
| https://twitter.com/matthew_d_green/status/996371541591019520 | Third Party Advisory | |
| https://www.synology.com/support/security/Synology_SA_18_22 | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://efail.de | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| 9folders Search vendor "9folders" | Nine Search vendor "9folders" for product "Nine" | - | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mail Search vendor "Apple" for product "Mail" | - | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mail Search vendor "Apple" for product "Mail" | - | iphone_os |
Affected
| ||||||
| Bloop Search vendor "Bloop" | Airmail Search vendor "Bloop" for product "Airmail" | - | - |
Affected
| ||||||
| Emclient Search vendor "Emclient" | Emclient Search vendor "Emclient" for product "Emclient" | - | - |
Affected
| ||||||
| Flipdogsolutions Search vendor "Flipdogsolutions" | Maildroid Search vendor "Flipdogsolutions" for product "Maildroid" | - | - |
Affected
| ||||||
| Freron Search vendor "Freron" | Mailmate Search vendor "Freron" for product "Mailmate" | - | - |
Affected
| ||||||
| Gnome Search vendor "Gnome" | Evolution Search vendor "Gnome" for product "Evolution" | - | - |
Affected
| ||||||
| Google Search vendor "Google" | Gmail Search vendor "Google" for product "Gmail" | - | - |
Affected
| ||||||
| Horde Search vendor "Horde" | Horde Imp Search vendor "Horde" for product "Horde Imp" | - | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Notes Search vendor "Ibm" for product "Notes" | - | - |
Affected
| ||||||
| Kde Search vendor "Kde" | Kmail Search vendor "Kde" for product "Kmail" | - | - |
Affected
| ||||||
| Kde Search vendor "Kde" | Trojita Search vendor "Kde" for product "Trojita" | - | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Outlook Search vendor "Microsoft" for product "Outlook" | 2007 Search vendor "Microsoft" for product "Outlook" and version "2007" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Outlook Search vendor "Microsoft" for product "Outlook" | 2010 Search vendor "Microsoft" for product "Outlook" and version "2010" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Outlook Search vendor "Microsoft" for product "Outlook" | 2013 Search vendor "Microsoft" for product "Outlook" and version "2013" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Outlook Search vendor "Microsoft" for product "Outlook" | 2016 Search vendor "Microsoft" for product "Outlook" and version "2016" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | - | - |
Affected
| ||||||
| Postbox-inc Search vendor "Postbox-inc" | Postbox Search vendor "Postbox-inc" for product "Postbox" | - | - |
Affected
| ||||||
| R2mail2 Search vendor "R2mail2" | R2mail2 Search vendor "R2mail2" for product "R2mail2" | - | - |
Affected
| ||||||
| Ritlabs Search vendor "Ritlabs" | The Bat Search vendor "Ritlabs" for product "The Bat" | - | - |
Affected
| ||||||