PT-2017-17592 · Vaultive · Vaultive O365

Daniel Kahn Gillmor · Published 2017-05-03 · Updated 2017-05-16 · CVE-2017-7229

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Vaultive O365 versions prior to 4.5.21

Description The issue affects PGP/MIME encrypted messages processed by the Vaultive O365 frontend. When such messages are injected via IMAP or SMTP, their Content-Type is altered from 'multipart/encrypted' to 'text/plain'. This modification causes most PGP/MIME-capable mail user agents to fail at decrypting the messages properly, resulting in a Denial of Service. A common consequence of this issue is that senders are requested to resend the emails without encryption, potentially leading to Information Disclosure.

Recommendations For versions prior to 4.5.21, update to version 4.5.21 or later to resolve the issue.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2017-7229

Affected Products

Vaultive O365

References · 3

• https://osv.dev/vulnerability/CVE-2017-7229 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7229 · Security Note
• https://gist.github.com/dkg/a1998c861bf2430e0d01d586905b11cb · Note