{"id":"CVE-2017-17688","aliases":["DEBIAN-CVE-2017-17688","EUVD-2017-8845","GHSA-87q6-mg5f-mp98","UBUNTU-CVE-2017-17688","openSUSE-SU-2018:1329-1","openSUSE-SU-2018:1330-1","openSUSE-SU-2024:10736-1"],"status":"disputed","title":"** DISPUTED ** The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget...","description":"The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05443,"percentile":0.92783,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-05-16T19:00:00Z","modified":"2026-08-04T05:47:54Z","fixes":[{"ecosystem":"Debian:11","package":"enigmail","fixed_in":["2:2.0.6.1-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.0.6.1-4"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1.4"}]}],"bundled":5}],"products":[{"vendor":"apple","product":"mail"},{"vendor":"bloop","product":"airmail"},{"vendor":"emclient","product":"emclient"},{"vendor":"flipdogsolutions","product":"maildroid"},{"vendor":"freron","product":"mailmate"},{"vendor":"horde","product":"horde_imp"},{"vendor":"microsoft","product":"outlook"},{"vendor":"mozilla","product":"thunderbird"},{"vendor":"postbox-inc","product":"postbox"},{"vendor":"r2mail2","product":"r2mail2"},{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://protonmail.com/blog/pgp-vulnerability-efail","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://news.ycombinator.com/item?id=17066419","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.patreon.com/posts/cybersecurity-15-18814817","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/104162","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://efail.de","tags":["x_refsource_MISC","x_transferred","Exploit","Mitigation","Third Party Advisory","evidence","report"]},{"url":"https://twitter.com/matthew_d_green/status/995996706457243648","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.synology.com/support/security/Synology_SA_18_22","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1040904","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17688"},{"url":"https://github.com/advisories/GHSA-87q6-mg5f-mp98"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-17688","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-17688","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-17688","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RNZBPQATLVKCT7P5YVUXDDVDFKRPUWP6/#RNZBPQATLVKCT7P5YVUXDDVDFKRPUWP6","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1093151","tags":["report"]},{"url":"https://bugzilla.suse.com/1093152","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17689","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OTHLYEPMU5SK5PDODY44XQQ6DR7FWSLS/#OTHLYEPMU5SK5PDODY44XQQ6DR7FWSLS","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12269","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-17688","description":"The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification","status":"disputed","published":"2018-05-16T19:00:00Z","modified":"2024-08-05T20:59:17.546Z","updated_at":"2026-11-02T14:33:18.556155Z"}],"euvd":[{"id":"EUVD-2017-8845","description":"The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification","status":"published","published":"2018-05-16T19:00:00Z","modified":"2024-08-05T20:59:17Z","updated_at":"2026-11-03T02:23:08.959608Z"}],"ghsa":[{"id":"GHSA-87q6-mg5f-mp98","title":"** DISPUTED ** The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget...","description":"** DISPUTED ** The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification.","status":"published","published":"2022-05-13T01:44:27Z","modified":"2023-02-02T05:01:07Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T14:51:06.494699Z"}],"nvd":[{"id":"CVE-2017-17688","description":"The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification","status":"disputed","published":"2018-05-16T19:29:00.223Z","modified":"2026-06-17T01:11:29.613Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"CVE-2017-17688","description":"The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification","status":"published","published":"2018-05-16T19:29:00.223Z","modified":"2026-03-15T22:24:06.120647Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-17688","description":"The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification","status":"published","published":"2018-05-16T19:29:00.223Z","modified":"2026-08-04T05:47:54.185763955Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-17688","description":"** DISPUTED ** The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification.","status":"withdrawn","published":"2018-05-16T19:29:00Z","modified":"2025-07-16T07:36:26.041665Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"openSUSE-SU-2018:1329-1","title":"Security update for enigmail","description":"This update for enigmail to version 2.0.4 fixes multiple issues.\n\nSecurity issues fixed:\n\n- CVE-2017-17688: CFB gadget attacks allowed to exfiltrate plaintext out of encrypted emails.\n  enigmail now fails on GnuPG integrity check warnings for old Algorithms (bsc#1093151)\n- CVE-2017-17689: CBC gadget attacks allows to exfiltrate plaintext out of encrypted emails (bsc#1093152)\n\nThis update also includes new and updated functionality:\n\n- The Encryption and Signing buttons now work for both OpenPGP and S/MIME.\n  Enigmail will chose between S/MIME or OpenPGP depending on whether the keys\n  for all recipients are available for the respective standard\n- Support for the Autocrypt standard, which is now enabled by default\n- Support for Pretty Easy Privacy (p≡p)\n- Support for Web Key Directory (WKD)\n- The message subject can now be encrypted and replaced with a dummy subject,\n  following the Memory Hole standard forprotected Email Headers\n- keys on keyring are automatically refreshed from keyservers at irregular intervals\n- Subsequent updates of Enigmail no longer require a restart of Thunderbird \n- Keys are internally addressed using the fingerprint instead of the key ID","status":"published","published":"2018-05-17T11:35:48Z","modified":"2026-02-04T02:58:28.24307Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2018:1330-1","title":"Security update for enigmail","description":"This update for enigmail to version 2.0.4 fixes multiple issues.\n\nSecurity issues fixed:\n\n- CVE-2017-17688: CFB gadget attacks allowed to exfiltrate plaintext out of encrypted emails.\n  enigmail now fails on GnuPG integrity check warnings for old Algorithms (bsc#1093151)\n- CVE-2017-17689: CBC gadget attacks allows to exfiltrate plaintext out of encrypted emails (bsc#1093152)\n\nThis update also includes new and updated functionality:\n\n- The Encryption and Signing buttons now work for both OpenPGP and S/MIME.\n  Enigmail will chose between S/MIME or OpenPGP depending on whether the keys\n  for all recipients are available for the respective standard\n- Support for the Autocrypt standard, which is now enabled by default\n- Support for Pretty Easy Privacy (p≡p)\n- Support for Web Key Directory (WKD)\n- The message subject can now be encrypted and replaced with a dummy subject,\n  following the Memory Hole standard forprotected Email Headers\n- keys on keyring are automatically refreshed from keyservers at irregular intervals\n- Subsequent updates of Enigmail no longer require a restart of Thunderbird \n- Keys are internally addressed using the fingerprint instead of the key ID","status":"published","published":"2018-05-17T11:35:48Z","modified":"2026-02-04T02:20:13.938333Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10736-1","title":"enigmail-2.2.4-1.4 on GA media","description":"These are all security issues fixed in the enigmail-2.2.4-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:09:52.409086Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}