CVE-2017-17689 — Sensitive Information Exposure in Microsoft Outlook
Severity
5.9MEDIUMNVD
EPSS
0.4%
top 36.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 16
Latest updateSep 2
Description
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6
Affected Packages1 packages
🔴Vulnerability Details
6GHSA▶
GHSA-xv45-9768-g2mm: The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL↗2022-05-13
OSV▶
CVE-2017-17689: The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL↗2018-05-16
📋Vendor Advisories
5Red Hat
▶
Debian▶
CVE-2017-17689: evolution - The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadge...↗2017
💬Community
8Bugzilla▶
CVE-2017-17689 S/MIME: CBC gadget attacks allows to exfiltrate plaintext out of encrypted emails↗2018-05-14