CVE-2017-17845

An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-01-001.

Score

CVSS 3.0 7.3 High

Status

Modified - cve@mitre.org

Published

2017-12-27

Last modified

2024-08-05

Weaknesses

CWE-338

Affected products

• Debian Linux (Debian)
• Enigmail (Enigmail)

References

• https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf
• https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html
• https://lists.debian.org/debian-security-announce/2017/msg00333.html
• https://www.debian.org/security/2017/dsa-4070
• https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html