PT-2017-17592 · Vaultive · Vaultive O365

Daniel Kahn Gillmor · Publicado 2017-05-03 · Atualizado 2017-05-16 · CVE-2017-7229

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Vaultive O365 versions prior to 4.5.21

Description The issue affects PGP/MIME encrypted messages processed by the Vaultive O365 frontend. When such messages are injected via IMAP or SMTP, their Content-Type is altered from 'multipart/encrypted' to 'text/plain'. This modification causes most PGP/MIME-capable mail user agents to fail at decrypting the messages properly, resulting in a Denial of Service. A common consequence of this issue is that senders are requested to resend the emails without encryption, potentially leading to Information Disclosure.

Recommendations For versions prior to 4.5.21, update to version 4.5.21 or later to resolve the issue.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2017-7229

Produtos afetados

Vaultive O365

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-7229 · Aviso do Fabricante
• https://gist.github.com/dkg/a1998c861bf2430e0d01d586905b11cb · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7229 · Nota de Segurança