{"id":"CVE-2017-17844","aliases":["DEBIAN-CVE-2017-17844","DLA-1219-1","DSA-4070-1","EUVD-2017-8991","GHSA-v476-27v8-hrp8","MGASA-2017-0477","UBUNTU-CVE-2017-17844"],"status":"published","title":"An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content...","description":"An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 \"replay\" issue.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01353,"percentile":0.71742,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-319"],"published":"2017-12-21T00:00:00Z","modified":"2026-08-04T05:48:14Z","fixes":[{"ecosystem":"Debian:11","package":"enigmail","fixed_in":["2:1.9.9-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"enigmail","fixed_in":["2:1.9.9-0ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"enigmail","fixed_in":["2:1.9.9-0ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-1~deb7u1"}]}],"versions":["2:1.4.1-2","2:1.4.1exp-1","2:1.4.5+id16-1","2:1.4.6+id16-1","2:1.4.6+id17-1","2:1.5.0+id17-1","2:1.5.0+id17-2","2:1.5.1+id17-1","2:1.5.1+id17-2","2:1.5.1+id17-3","2:1.5.1+id17-3~deb7u1","2:1.5.1+id17-4","2:1.6+git0.20140323-1","2:1.6+git0.20140323-2","2:1.6-1","2:1.6-2","2:1.6-3","2:1.6-4","2:1.6-4~deb7u1","2:1.7-1","2:1.7.2-1","2:1.7.2-1~deb7u1","2:1.7.2-2","2:1.7.2-3","2:1.7~git0.20140707-1","2:1.8-1","2:1.8.1-1","2:1.8.2-1","2:1.8.2-2","2:1.8.2-3","2:1.8.2-4","2:1.8.2-4~deb7u1","2:1.8.2-4~deb7u2","2:1.8.2-4~deb8u1","2:1.8.2~beta3-1","2:1.9-1","2:1.9.1-1","2:1.9.1-2","2:1.9.2-1","2:1.9.3-1","2:1.9.3-2","2:1.9.4-1","2:1.9.5-1","2:1.9.5-2","2:1.9.5-3","2:1.9.5-4","2:1.9.5-5","2:1.9.5-6","2:1.9.5-7","2:1.9.6-1","2:1.9.6-2","2:1.9.7-1","2:1.9.7-2","2:1.9.8-1","2:1.9.8.1-1","2:1.9.8.1-1~deb7u1","2:1.9.8.1-1~deb8u1","2:1.9.8.1-1~deb9u1","2:1.9.8.2-1","2:1.9.8.2-2","2:1.9.8.3-1","2:1.9~beta1-1","2:1.9~beta2-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:8","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-1~deb8u1"}]}],"versions":["2:1.7.2-3","2:1.8-1","2:1.8.1-1","2:1.8.2-1","2:1.8.2-2","2:1.8.2-3","2:1.8.2-4","2:1.8.2-4~deb7u1","2:1.8.2-4~deb7u2","2:1.8.2-4~deb8u1","2:1.8.2~beta3-1","2:1.9-1","2:1.9.1-1","2:1.9.1-2","2:1.9.2-1","2:1.9.3-1","2:1.9.3-2","2:1.9.4-1","2:1.9.5-1","2:1.9.5-2","2:1.9.5-3","2:1.9.5-4","2:1.9.5-5","2:1.9.5-6","2:1.9.5-7","2:1.9.6-1","2:1.9.6-2","2:1.9.7-1","2:1.9.7-2","2:1.9.8-1","2:1.9.8.1-1","2:1.9.8.1-1~deb7u1","2:1.9.8.1-1~deb8u1","2:1.9.8.1-1~deb9u1","2:1.9.8.2-1","2:1.9.8.2-2","2:1.9.8.3-1","2:1.9.9-1~deb7u1","2:1.9~beta1-1","2:1.9~beta2-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:9","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-1~deb9u1"}]}],"versions":["2:1.9.7-2","2:1.9.8-1","2:1.9.8.1-1","2:1.9.8.1-1~deb7u1","2:1.9.8.1-1~deb8u1","2:1.9.8.1-1~deb9u1","2:1.9.8.2-1","2:1.9.8.2-2","2:1.9.8.3-1","2:1.9.9-1~deb7u1","2:1.9.9-1~deb8u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.5.2-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.5.2-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.5.2-1.mga6"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.5.2-1.mga6"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-0ubuntu0.14.04.1"}]}],"versions":["2:1.5.2-0ubuntu1","2:1.7-0ubuntu0.14.04.1","2:1.7.2-0ubuntu0.14.04.1","2:1.8.2-0ubuntu0.14.04.1","2:1.9.7-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-0ubuntu0.16.04.1"}]}],"versions":["2:1.8.2-0ubuntu1","2:1.8.2-4fakesync1","2:1.9.1-1","2:1.9.7-1~ubuntu0.16.04.1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"enigmail","product":"enigmail"}],"references":[{"url":"https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-security-announce/2017/msg00333.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.debian.org/security/2017/dsa-4070","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17844"},{"url":"https://www.mail-archive.com/enigmail-users@enigmail.net/msg04280.html","tags":["report"]},{"url":"https://github.com/advisories/GHSA-v476-27v8-hrp8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-17844","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0477.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22251","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-17844","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-17844","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-17844","description":"An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 \"replay\" issue.","status":"published","published":"2017-12-22T23:00:00Z","modified":"2024-08-05T21:06:49.166Z","updated_at":"2026-11-02T14:33:18.248329Z"}],"euvd":[{"id":"EUVD-2017-8991","description":"An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 \"replay\" issue.","status":"published","published":"2017-12-22T23:00:00Z","modified":"2024-08-05T21:06:49Z","updated_at":"2026-11-03T02:23:08.488418Z"}],"ghsa":[{"id":"GHSA-v476-27v8-hrp8","title":"An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content...","description":"An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 \"replay\" issue.","status":"published","published":"2022-05-13T01:44:30Z","modified":"2025-04-20T03:51:33Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T15:01:57.945283Z"}],"nvd":[{"id":"CVE-2017-17844","description":"An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 \"replay\" issue.","status":"published","published":"2017-12-27T17:08:19.717Z","modified":"2026-06-17T01:11:45.567Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:04:11.215487Z"}],"osv":[{"id":"CVE-2017-17844","description":"An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 \"replay\" issue.","status":"published","published":"2017-12-27T17:08:19.717Z","modified":"2026-04-16T06:26:08.051751272Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-17844","description":"An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 \"replay\" issue.","status":"published","published":"2017-12-27T17:08:19.717Z","modified":"2026-08-04T05:48:14.731554074Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-17844","description":"An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 \"replay\" issue.","status":"published","published":"2017-12-27T17:08:00Z","modified":"2025-07-16T07:36:27.434193Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"DLA-1219-1","title":"enigmail - security update","status":"published","published":"2017-12-23T00:00:00Z","modified":"2026-03-09T01:01:31.645668Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4070-1","title":"enigmail - security update","status":"published","published":"2017-12-21T00:00:00Z","modified":"2026-03-09T01:19:12.102939Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0477","title":"Updated thunderbird packages fix security vulnerabilities","description":"Multiple vulnerabilities have been fixed in thunderbird.\n* JavaScript Execution via RSS in mailbox:// origin (CVE-2017-7846).\n* Local path string can be leaked from RSS feed (CVE-2017-7847).\n* RSS Feed vulnerable to new line Injection (CVE-2017-7848).\n* Mailsploit From address with encoded null character is cut off in\nmessage header display (CVE-2017-7829).\n\nMultiple vulnerabilities have been fixed in the bundled enigmail package.\n* An issue was discovered that allows remote attackers to trigger use of\nan intended public key for encryption, because incorrect regular\nexpressions are used for extraction of an e-mail address from a\ncomma-separated list (CVE-2017-17843).\n* A remote attacker can obtain cleartext content by sending an encrypted\ndata block to a victim, and relying on the victim to automatically\ndecrypt that block and then send it back to the attacker as quoted text\n(CVE-2017-17844).\n* An issue was discovered where Improper Random Secret Generation occurs\nbecause Math.Random() is used by pretty Easy privacy (pEp)\n(CVE-2017-17845).\n* An issue was discovered where regular expressions are exploitable for\nDenial of Service, because of attempts to match arbitrarily long strings\n(CVE-2017-17846).\n* An issue was discovered that signature spoofing is possible because\nthe UI does not properly distinguish between an attachment signature,\nand a signature that applies to the entire containing message\n(CVE-2017-17847).\n* In a variant of CVE-2017-17847, signature spoofing is possible for\nmultipart/related messages because a signed message part can be\nreferenced with a cid: URI but not actually displayed (CVE-2017-17848)\n","status":"published","published":"2017-12-31T00:10:15Z","modified":"2026-05-16T06:30:52.454698Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}