CVE-2017-17689
Summary
| CVE | CVE-2017-17689 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-05-16 19:29:00 UTC |
| Updated | 2019-10-03 00:03:00 UTC |
| Description | The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | 9folders | Nine | - | All | All | All |
| Application | 9folders | Nine | - | All | All | All |
| Application | Apple | - | All | All | All | |
| Application | Apple | - | All | All | All | |
| Application | Apple | - | All | All | All | |
| Application | Apple | - | All | All | All | |
| Application | Bloop | Airmail | - | All | All | All |
| Application | Bloop | Airmail | - | All | All | All |
| Application | Emclient | Emclient | - | All | All | All |
| Application | Emclient | Emclient | - | All | All | All |
| Application | Flipdogsolutions | Maildroid | - | All | All | All |
| Application | Flipdogsolutions | Maildroid | - | All | All | All |
| Application | Freron | Mailmate | - | All | All | All |
| Application | Freron | Mailmate | - | All | All | All |
| Application | Gnome | Evolution | - | All | All | All |
| Application | Gnome | Evolution | - | All | All | All |
| Application | Gmail | - | All | All | All | |
| Application | Gmail | - | All | All | All | |
| Application | Horde | Horde Imp | - | All | All | All |
| Application | Horde | Horde Imp | - | All | All | All |
| Application | Ibm | Notes | - | All | All | All |
| Application | Ibm | Notes | - | All | All | All |
| Application | Kde | Kmail | - | All | All | All |
| Application | Kde | Kmail | - | All | All | All |
| Application | Kde | Trojita | - | All | All | All |
| Application | Kde | Trojita | - | All | All | All |
| Application | Microsoft | Outlook | 2007 | All | All | All |
| Application | Microsoft | Outlook | 2010 | All | All | All |
| Application | Microsoft | Outlook | 2013 | All | All | All |
| Application | Microsoft | Outlook | 2016 | All | All | All |
| Application | Microsoft | Outlook | 2007 | All | All | All |
| Application | Microsoft | Outlook | 2010 | All | All | All |
| Application | Microsoft | Outlook | 2013 | All | All | All |
| Application | Microsoft | Outlook | 2016 | All | All | All |
| Application | Mozilla | Thunderbird | - | All | All | All |
| Application | Mozilla | Thunderbird | - | All | All | All |
| Application | Postbox-inc | Postbox | - | All | All | All |
| Application | Postbox-inc | Postbox | - | All | All | All |
| Application | R2mail2 | R2mail2 | - | All | All | All |
| Application | R2mail2 | R2mail2 | - | All | All | All |
| Application | Ritlabs | The Bat | - | All | All | All |
| Application | Ritlabs | The Bat | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| EFAIL | MISC | efail.de | Exploit, Mitigation, Third Party Advisory |
| Multiple Products S/MIME CVE-2017-17689 Man In The Middle Information Disclosure Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Matthew Green na Twitterze: "Someone asked me to summarize my views on the Efail matter, and the “controversy” in the PGP community. In case my rants yesterday were too incoherent for you, this is how I responded. https://t.co/D5L2Txm8PH… https://t.co/lFVqcLvVnt" | MISC | twitter.com | Third Party Advisory |
| My thoughts about Efail are a bit more nuanced. First off, the real story her - Pastebin.com | MISC | pastebin.com | Third Party Advisory |
| Let's summarize the situation: Abstract: S/MIME and MUAs are broken. OpenPGP (... | Hacker News | MISC | news.ycombinator.com | Issue Tracking, Third Party Advisory |
| Synology Inc. | CONFIRM | www.synology.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.