CVE-2017-17847
published 2017-12-27CVE-2017-17847: An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a…
PriorityP335high7.5CVSS 3.0
AVNACLPRNUINSUCNIHAN
EPSS
1.20%
64.5th percentile
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | enigmail | < enigmail 2:1.9.9-1 (bullseye) | enigmail 2:1.9.9-1 (bullseye) |
| enigmail | enigmail | < 1.9.9 | 1.9.9 |
| enigmail | enigmail | >= 0 < 2:1.9.9-1 | 2:1.9.9-1 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gvxj-mgw2-9vg3: An issue was discovered in Enigmail before 1
ghsa_unreviewed·2022-05-14·CVSS 7.5
CVE-2017-17848 [HIGH] CWE-347 GHSA-gvxj-mgw2-9vg3: An issue was discovered in Enigmail before 1
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
GHSA
GHSA-c53x-x7fc-9vrp: An issue was discovered in Enigmail before 1
ghsa_unreviewed·2022-05-14
CVE-2017-17847 [HIGH] CWE-347 GHSA-c53x-x7fc-9vrp: An issue was discovered in Enigmail before 1
An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format.
OSV
CVE-2017-17847: An issue was discovered in Enigmail before 1
osv·2017-12-27·CVSS 7.5
CVE-2017-17847 [HIGH] CVE-2017-17847: An issue was discovered in Enigmail before 1
An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format.
OSV
CVE-2017-17848: An issue was discovered in Enigmail before 1
osv·2017-12-27·CVSS 7.5
CVE-2017-17848 [HIGH] CVE-2017-17848: An issue was discovered in Enigmail before 1
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
Debian
CVE-2017-17848: enigmail - An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847...
vendor_debian·2017·CVSS 7.5
CVE-2017-17848 [HIGH] CVE-2017-17848: enigmail - An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847...
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
Scope: local
bullseye: resolved (fixed in 2:1.9.9-1)
Debian
CVE-2017-17847: enigmail - An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible...
vendor_debian·2017·CVSS 7.5
CVE-2017-17847 [HIGH] CVE-2017-17847: enigmail - An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible...
An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format.
Scope: local
bullseye: resolved (fixed in 2:1.9.9-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlhttp://seclists.org/fulldisclosure/2019/Apr/38http://www.openwall.com/lists/oss-security/2019/04/30/4https://github.com/RUB-NDS/Johnny-You-Are-Firedhttps://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdfhttps://lists.debian.org/debian-lts-announce/2017/12/msg00021.htmlhttps://lists.debian.org/debian-security-announce/2017/msg00333.htmlhttps://sourceforge.net/p/enigmail/bugs/709/https://www.debian.org/security/2017/dsa-4070http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlhttp://seclists.org/fulldisclosure/2019/Apr/38http://www.openwall.com/lists/oss-security/2019/04/30/4https://github.com/RUB-NDS/Johnny-You-Are-Firedhttps://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdfhttps://lists.debian.org/debian-lts-announce/2017/12/msg00021.htmlhttps://lists.debian.org/debian-security-announce/2017/msg00333.htmlhttps://sourceforge.net/p/enigmail/bugs/709/https://www.debian.org/security/2017/dsa-4070
2017-12-27
Published