Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2017-17688 Details

Description

The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:5.9 MEDIUMVector:CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html	CVE	Third Party Advisory
https://efail.de	CVE	ExploitMitigationThird Party Advisory
https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html	CVE	Third Party Advisory
https://news.ycombinator.com/item?id=17066419	CVE	Issue TrackingThird Party Advisory
https://protonmail.com/blog/pgp-vulnerability-efail	CVE	Issue TrackingThird Party Advisory
https://twitter.com/matthew_d_green/status/995996706457243648	CVE	Third Party Advisory
https://www.patreon.com/posts/cybersecurity-15-18814817	CVE	Issue TrackingThird Party Advisory
https://www.synology.com/support/security/Synology_SA_18_22	CVE	Third Party Advisory
http://www.securityfocus.com/bid/104162	CVE	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040904	CVE	Third Party AdvisoryVDB Entry
http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html	[email protected]	Third Party Advisory
https://efail.de	[email protected]	ExploitMitigationThird Party Advisory
https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html	[email protected]	Third Party Advisory
https://news.ycombinator.com/item?id=17066419	[email protected]	Issue TrackingThird Party Advisory
https://protonmail.com/blog/pgp-vulnerability-efail	[email protected]	Issue TrackingThird Party Advisory
https://twitter.com/matthew_d_green/status/995996706457243648	[email protected]	Third Party Advisory
https://www.patreon.com/posts/cybersecurity-15-18814817	[email protected]	Issue TrackingThird Party Advisory
https://www.synology.com/support/security/Synology_SA_18_22	[email protected]	Third Party Advisory
http://www.securityfocus.com/bid/104162	[email protected]	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040904	[email protected]	Third Party AdvisoryVDB Entry

see all 20 references

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-noinfo	Insufficient Information to Classify Weakness	[email protected]

Affected Products

Product	Versions
apple mail	All versions
CPE cpe:2.3:a:apple:mail:-:::::::* cpe:2.3:a:apple:mail:-:::::iphone_os:: Remediation No remediation found in references.
bloop airmail	All versions
CPE cpe:2.3:a:bloop:airmail:-:::::::* Remediation No remediation found in references.
emclient emclient	All versions
CPE cpe:2.3:a:emclient:emclient:-:::::::* Remediation No remediation found in references.
flipdogsolutions maildroid	All versions
CPE cpe:2.3:a:flipdogsolutions:maildroid:-:::::::* Remediation No remediation found in references.
freron mailmate	All versions
CPE cpe:2.3:a:freron:mailmate:-:::::::* Remediation No remediation found in references.
horde horde imp	All versions
CPE cpe:2.3:a:horde:horde_imp:-:::::::* Remediation No remediation found in references.
microsoft outlook	2007
CPE cpe:2.3:a:microsoft:outlook:2007:::::::* Remediation No remediation found in references.
mozilla thunderbird	All versions
CPE cpe:2.3:a:mozilla:thunderbird:-:::::::* Remediation No remediation found in references.
postbox-inc postbox	All versions
CPE cpe:2.3:a:postbox-inc:postbox:-:::::::* Remediation No remediation found in references.
r2mail2 r2mail2	All versions
CPE cpe:2.3:a:r2mail2:r2mail2:-:::::::* Remediation No remediation found in references.
roundcube webmail	All versions
CPE cpe:2.3:a:roundcube:webmail:-:::::::* Remediation No remediation found in references.

Change History

11 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
Aug 5, 2024	CVE Modified	[email protected]
May 17, 2024	CVE Modified	[email protected]
May 14, 2024	CVE Modified	[email protected]
Apr 11, 2024	CVE Modified	[email protected]
Mar 21, 2024	CVE Modified	[email protected]
Nov 7, 2023	CVE Modified	[email protected]
Oct 3, 2019	CWE Remap	[email protected]
Jun 27, 2018	Initial Analysis	[email protected]
May 18, 2018	CVE Modified	[email protected]

CVE-2017-17688 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO