An issue was discovered in Enigmail before 1.9.9. In a...
Vulnerability Description
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-17848
Credits & Attribution
No credits recorded in the NVD database.
References
- https://sourceforge.net/p/enigmail/bugs/709/
- https://lists.debian.org/debian-security-announce/2017/msg00333.html
- https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html
- https://www.debian.org/security/2017/dsa-4070
- http://www.openwall.com/lists/oss-security/2019/04/30/4
- http://seclists.org/fulldisclosure/2019/Apr/38
- http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
- https://github.com/RUB-NDS/Johnny-You-Are-Fired
- https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
More from enigmail
View All →Affected Vendor
enigmail
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.