Homepage

Inadequate Encryption Strength The advisory has been revoked - it doesn't affect any version of package enigmail  (opens in a new tab)

Threat Intelligence

EPSS
0.24% (64th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Inadequate Encryption Strength vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIAN9-ENIGMAIL-458078
  • published6 Aug 2019
  • disclosed5 Aug 2019
Report a new vulnerability Found a mistake?

Introduced: 5 Aug 2019

CVE-2019-14664  (opens in a new tab)
CWE-326  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream enigmail package and not the enigmail package as distributed by Debian.

In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, he unknowingly leaks the plaintext of the encrypted message part(s) back to the attacker. This attack variant bypasses protection mechanisms implemented after the "EFAIL" attacks.

References