PT-2017-15039 · Enigmail · Enigmail

Publicado

2017-12-21

·

Atualizado

2019-10-03

·

CVE-2017-17843

CVSS v3.1

5.9

Média

VetorAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Enigmail versions prior to 1.9.9
Description A problem has been discovered that allows remote attackers to trigger the use of an intended public key for encryption. This issue arises due to the use of incorrect regular expressions for extracting an email address from a comma-separated list. It can be demonstrated through a modified Full Name field and a homograph attack.
Recommendations For versions prior to 1.9.9, update to version 1.9.9 or later to resolve the issue. As a temporary workaround, consider restricting the use of public keys for encryption until the update is applied.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2017-17843
DLA-1219-1
DSA-4070-1
MGASA-2017-0477

Produtos afetados

Enigmail