Homepage

CVE-2017-17688 The advisory has been revoked - it doesn't affect any version of package enigmail  (opens in a new tab)

Threat Intelligence

Exploit Maturity
Not Defined
EPSS
0.52% (77th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-ENIGMAIL-1544892
  • published16 May 2018
  • disclosed16 May 2018
Report a new vulnerability Found a mistake?

Introduced: 16 May 2018

CVE-2017-17688  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:12.

NVD Description

Note: Versions mentioned in the description apply only to the upstream enigmail package and not the enigmail package as distributed by Debian.

The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification