Homepage

Improper Verification of Cryptographic Signature The advisory has been revoked - it doesn't affect any version of package enigmail  (opens in a new tab)

Threat Intelligence

EPSS
0.48% (76th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN9-ENIGMAIL-324094
  • published27 Dec 2017
  • disclosed27 Dec 2017
Report a new vulnerability Found a mistake?

Introduced: 27 Dec 2017

CVE-2017-17847  (opens in a new tab)
CWE-347  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream enigmail package and not the enigmail package as distributed by Debian.

An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format.