CVE-2017-17688

MEDIUM

Apple Mail - Plaintext Exfiltration via OpenPGP CFB Malleability-Gadget Attack

Title source: llm
STIX 2.1

Description

The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification

References (10)

Core 10
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://protonmail.com/blog/pgp-vulnerability-efail
Issue Tracking, Third Party Advisory x_refsource_misc
https://news.ycombinator.com/item?id=17066419
Issue Tracking, Third Party Advisory x_refsource_misc
https://www.patreon.com/posts/cybersecurity-15-18814817
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/104162
Exploit, Mitigation, Third Party Advisory x_refsource_misc
https://efail.de
Third Party Advisory x_refsource_confirm
https://www.synology.com/support/security/Synology_SA_18_22
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040904

Scores

CVSS v3 5.9
EPSS 0.0284
EPSS Percentile 86.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

Status published
Products (11)
apple/mail (2 CPE variants)
bloop/airmail
emclient/emclient
flipdogsolutions/maildroid
freron/mailmate
horde/horde_imp
microsoft/outlook 2007
mozilla/thunderbird
postbox-inc/postbox
r2mail2/r2mail2
... and 1 more
Published May 16, 2018
Tracked Since Feb 18, 2026