CVE-2017-17689

The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

CVSS v3.0

5.9 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

4.29% chance of exploitation in the next 30 days, 90th percentile

Published

2018-05-16

Updated

2024-08-05

Proof-of-concept exploits (1)

• jaads/Efail-malleability-gadget-exploit5★ · 2022-11-24

References

• CVE Record
• NVD entry

Related

• CVE-2017-17688
• CVE-2017-17692
• CVE-2017-17684
• CVE-2017-17707
• CVE-2017-17683
• CVE-2017-17708