CVE-2017-17689

MEDIUM

9folders nine - Plaintext Exfiltration via S/MIME CBC Malleability-Gadget Attack

Title source: llm
STIX 2.1

Description

The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

References (6)

Core 6
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://news.ycombinator.com/item?id=17066419
Third Party Advisory x_refsource_misc
https://pastebin.com/gNCc8aYm
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/104165
Exploit, Mitigation, Third Party Advisory x_refsource_misc
https://efail.de
Third Party Advisory x_refsource_confirm
https://www.synology.com/support/security/Synology_SA_18_22

Scores

CVSS v3 5.9
EPSS 0.0045
EPSS Percentile 63.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

Status published
Products (20)
9folders/nine
apple/mail (2 CPE variants)
bloop/airmail
emclient/emclient
flipdogsolutions/maildroid
freron/mailmate
gnome/evolution
google/gmail
horde/horde_imp
ibm/notes
... and 10 more
Published May 16, 2018
Tracked Since Feb 18, 2026