CVE-2017-17845
HighSummary
An issue was discovered in Enigmail before 1.9.9 related to improper random secret generation. The use of Math.Random() by pretty Easy privacy (pEp) leads to this vulnerability.
Risk Assessment
Improper secret generation may weaken communication security, posing a risk to user data confidentiality.
Recommendation
It is recommended to update Enigmail to version 1.9.9 or later to mitigate this vulnerability.
Other vulnerabilities in Enigmail
See all- CVE-2017-17848High
An issue was discovered in Enigmail before version 1.9.9 related to signature spoofing in multipart/related messages. A signed message part can be referenced with a cid: URI but not actually displayed, leading to the entire message appearing signed while the recipient does not see any of the signed text.
- CVE-2017-17847High
An issue was discovered in Enigmail before 1.9.9 related to signature spoofing. The UI does not properly distinguish between an attachment signature and a signature that applies to the entire containing message, which may lead to unauthorized message authentication.
- CVE-2017-17846High
An issue was discovered in Enigmail before 1.9.9 related to regular expressions that can be exploited for Denial of Service by attempting to match arbitrarily long strings.
Original NVD description (English source)
An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-01-001.