CVE-2017-17689 The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
MediumCVSS 5.9
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/evolution(Debian:12) | All versions | No fix listed |
| debian/evolution(Debian:12) | = 3.46.4-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.46.4-2+deb12u1 | No fix listed |
| debian/evolution(Debian:12) | = 3.47.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.47.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.48.0-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.48.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.48.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.48.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.48.4-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.49.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.49.2-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.49.2-3 | No fix listed |
| debian/evolution(Debian:12) | = 3.49.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.50.0-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.50.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.50.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.50.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.51.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.0-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.1-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.1-3 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.1-4 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.2-1 | No fix listed |
Show 69 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/evolution(Debian:12) | = 3.52.2-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.53.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.53.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.54.0-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.54.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.54.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.54.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.54.3-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.55.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.55.1-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.55.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.55.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.0-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-10 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-3 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-4 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-5 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-7 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-8 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-9 | No fix listed |
| debian/evolution(Debian:13) | All versions | No fix listed |
| debian/evolution(Debian:13) | = 3.56.1-1 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.1-1+deb13u1 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-0+deb13u1 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-1 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-10 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-2 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-3 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-4 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-5 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-7 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-8 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-9 | No fix listed |
| debian/evolution(Debian:14) | All versions | No fix listed |
| debian/evolution(Debian:14) | = 3.56.1-1 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-1 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-10 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-2 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-3 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-4 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-5 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-7 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-8 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-9 | No fix listed |
| debian/kf5-messagelib(Debian:12) | < 4:18.08.1-1 | 4:18.08.1-1 |
| 9folders nine | All versions | No fix listed |
| apple mail | All versions | No fix listed |
| bloop airmail | All versions | No fix listed |
| emclient | All versions | No fix listed |
| flipdogsolutions maildroid | All versions | No fix listed |
| freron mailmate | All versions | No fix listed |
| GNOME evolution | All versions | No fix listed |
| Google gmail | All versions | No fix listed |
| horde imp | All versions | No fix listed |
| ibm notes | All versions | No fix listed |
| KDE kmail | All versions | No fix listed |
| KDE trojita | All versions | No fix listed |
| Microsoft outlook | = 2007 | No fix listed |
| Microsoft outlook | = 2010 | No fix listed |
| Microsoft outlook | = 2013 | No fix listed |
| Microsoft outlook | = 2016 | No fix listed |
| mozilla Thunderbird | All versions | No fix listed |
| postbox-inc postbox | All versions | No fix listed |
| r2mail2 | All versions | No fix listed |
| ritlabs the bat | All versions | No fix listed |
References
- Debian Security Tracker CVE-2017-17689 vendor-advisory
- 104165 third-party-advisory vdb-entry
- efail.de exploit mitigation third-party-advisory
- news.ycombinator.com issue-tracking third-party-advisory
- pastebin.com third-party-advisory
- twitter.com third-party-advisory
- www.synology.com third-party-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking