medium5.9

CVE-2017-17688

The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

Impact

The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification

Affected products

Vendor	Product	Affected versions
Apple	Mail	All versions
Bloop	Airmail	All versions
Emclient	Emclient	All versions
Flipdogsolutions	Maildroid	All versions
Freron	Mailmate	All versions
Horde	Horde Imp	All versions
Microsoft	Outlook	Version 2007
Mozilla	Thunderbird	All versions
Postbox-Inc	Postbox	All versions
R2mail2	R2mail2	All versions
Roundcube	Webmail	All versions

References

NVD record
CVE.org record
http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html
http://www.securityfocus.com/bid/104162
http://www.securitytracker.com/id/1040904
https://efail.de
https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html
https://news.ycombinator.com/item?id=17066419
https://protonmail.com/blog/pgp-vulnerability-efail
https://twitter.com/matthew_d_green/status/995996706457243648
https://www.patreon.com/posts/cybersecurity-15-18814817
https://www.synology.com/support/security/Synology_SA_18_22
http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html
http://www.securityfocus.com/bid/104162
http://www.securitytracker.com/id/1040904
https://efail.de
https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html
https://news.ycombinator.com/item?id=17066419
https://protonmail.com/blog/pgp-vulnerability-efail
https://twitter.com/matthew_d_green/status/995996706457243648
https://www.patreon.com/posts/cybersecurity-15-18814817
https://www.synology.com/support/security/Synology_SA_18_22