CVE-2017-17688

The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification

CVSS v3.0

5.9 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

5.66% chance of exploitation in the next 30 days, 92th percentile

Published

2018-05-16

Updated

2024-08-05

Proof-of-concept exploits (1)

• jaads/Efail-malleability-gadget-exploit5★ · 2022-11-24

References

• CVE Record
• NVD entry

Related

• CVE-2017-17689
• CVE-2017-17684
• CVE-2017-17683
• CVE-2017-17692
• CVE-2017-17682
• CVE-2017-17707