CVE-2017-17843
First published: Fri Dec 22 2017(Updated: )
An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/enigmail | 2:2.2.4-0.2~deb10u1 2:2.1.3+ds1-4~deb10u2 2:2.2.4-0.3 | |
| Enigmail | <1.9.9 | |
| Debian | =8.0 | |
| Debian | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf
- https://security-tracker.debian.org/tracker/CVE-2017-17843
- https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html
- https://lists.debian.org/debian-security-announce/2017/msg00333.html
- https://www.debian.org/security/2017/dsa-4070
- https://www.mail-archive.com/enigmail-users@enigmail.net/msg04280.html
- https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html
Frequently Asked Questions
What is the severity of CVE-2017-17843?
CVE-2017-17843 has a medium severity rating due to its potential for exploitation by remote attackers.
How do I fix CVE-2017-17843?
To fix CVE-2017-17843, upgrade to Enigmail version 1.9.9 or later.
Which versions of Enigmail are affected by CVE-2017-17843?
Enigmail versions prior to 1.9.9 are affected by CVE-2017-17843.
Can CVE-2017-17843 be exploited remotely?
Yes, CVE-2017-17843 can be exploited remotely if the conditions are met.
Is there a workaround for CVE-2017-17843 until I can update?
There is no specific workaround for CVE-2017-17843, and updating to a patched version is recommended.
- collector/security-tracker-debian
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/severity
- agent/author
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/enigmail
- canonical/enigmail
- vendor/debian
- canonical/debian
- version/debian/8.0
- version/debian/9.0