CVE-2017-17843: Medium severity enigmail vulnerability
Published Dec 22, 2017
·Updated
An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.
Affected Software
4 affected componentsFixes available
debian/enigmail
2:2.2.4-0.2~deb10u12:2.1.3+ds1-4~deb10u22:2.2.4-0.3
Enigmail Enigmail<1.9.9
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Event History
Dec 22, 2017
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-17843?
CVE-2017-17843 has a medium severity rating due to its potential for exploitation by remote attackers.
2
How do I fix CVE-2017-17843?
To fix CVE-2017-17843, upgrade to Enigmail version 1.9.9 or later.
3
Which versions of Enigmail are affected by CVE-2017-17843?
Enigmail versions prior to 1.9.9 are affected by CVE-2017-17843.
4
Can CVE-2017-17843 be exploited remotely?
Yes, CVE-2017-17843 can be exploited remotely if the conditions are met.
5
Is there a workaround for CVE-2017-17843 until I can update?
There is no specific workaround for CVE-2017-17843, and updating to a patched version is recommended.