CVE catalog

CVE-2017-17688

UBUNTU-CVE-2017-17688

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
5.44% · Oct 27, 2026

The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianenigmail112:2.0.6.1-4fixed
Opensuseenigmailtumbleweed2.2.4-1.4fixed
Suseenigmailpackage hub 122.0.4-9.1fixed
Suseenigmailpackage hub 122.0.4-9.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianenigmaildeb112:2.0.6.1-4Not reportedDEBIAN-CVE-2017-17688Not reported
Opensuseenigmailrpmtumbleweed2.2.4-1.4Not reportedOPENSUSE-SU-2024:10736-1Not reported
Suseenigmailrpmpackage hub 122.0.4-9.1Not reportedOPENSUSE-SU-2018:1329-1Not reported
Suseenigmailrpmpackage hub 122.0.4-9.1Not reportedOPENSUSE-SU-2018:1330-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]