PT-2017-15041 · Pep · Enigmail

Published 2017-12-21 · Updated 2018-02-04 · CVE-2017-17845

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Enigmail versions prior to 1.9.9

Description An issue was discovered in Enigmail where improper random secret generation occurs due to the use of Math.Random() by pretty Easy privacy (pEp).

Recommendations For versions prior to 1.9.9, update to version 1.9.9 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2017-17845

DLA-1219-1

DSA-4070-1

MGASA-2017-0477

Affected Products

Enigmail

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2017-17845 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17845 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0477 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-17845 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-17845 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-17845 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4070-1 · Vendor Advisory
• https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17845 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-17845 · Security Note
• https://advisories.mageia.org/MGASA-2017-0477.html · Security Note
• https://debian.org/security/2017/dsa-4070 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-30 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html · Note
• https://lists.debian.org/debian-security-announce/2017/msg00333.html · Note