CVE-2017-17689

The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

Score

CVSS 3.0 5.9 Medium

Status

Modified - cve@mitre.org

Published

2018-05-16

Last modified

2024-08-05

Affected products

• Nine (9folders)
• Mail (Apple)
• Airmail (Bloop)
• Emclient (Emclient)
• Maildroid (Flipdogsolutions)
• Mailmate (Freron)
• Evolution (Gnome)
• Gmail (Google)
• Horde Imp (Horde)
• Notes (Ibm)
• Kmail (Kde)
• Trojita (Kde)
• Outlook (Microsoft)
• Thunderbird (Mozilla)
• Postbox (Postbox-inc)
• R2mail2 (R2mail2)
• The Bat (Ritlabs)

References

• http://www.securityfocus.com/bid/104165
• https://efail.de
• https://news.ycombinator.com/item?id=17066419
• https://pastebin.com/gNCc8aYm
• https://twitter.com/matthew_d_green/status/996371541591019520
• https://www.synology.com/support/security/Synology_SA_18_22