PT-2017-15040 · Enigmail · Enigmail

Patrick Brunschwig · Published 2017-12-21 · Updated 2019-10-03 · CVE-2017-17844

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Enigmail versions prior to 1.9.9

Description A problem has been discovered where a remote attacker can obtain cleartext content by sending an encrypted data block to a victim and relying on the victim to automatically decrypt the block and then send it back to the attacker as quoted text. This issue is also known as the "replay" problem.

Recommendations For Enigmail versions prior to 1.9.9, update to version 1.9.9 or later to resolve the issue. As a temporary workaround, consider disabling automatic decryption of encrypted data blocks until a patch is available. Restrict the use of quoting text in encrypted conversations to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2017-17844

DLA-1219-1

DSA-4070-1

MGASA-2017-0477

Affected Products

Enigmail

References · 18

• https://osv.dev/vulnerability/DSA-4070-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-17844 · Vendor Advisory
• https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0477.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-17844 · Vendor Advisory
• https://debian.org/security/2017/dsa-4070 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17844 · Security Note
• https://ubuntu.com/security/CVE-2017-17844 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17844 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0477 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-17844 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2017-30 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=22251 · Note
• https://mail-archive.com/enigmail-users%40enigmail.net/msg04280.html · Note