CVE-2017-17848
HighSummary
An issue was discovered in Enigmail before version 1.9.9 related to signature spoofing in multipart/related messages. A signed message part can be referenced with a cid: URI but not actually displayed, leading to the entire message appearing signed while the recipient does not see any of the signed text.
Risk Assessment
Organizations may be exposed to fraud related to false signatures, which can lead to a loss of trust in communications and potential information leaks.
Recommendation
It is recommended to update Enigmail to version 1.9.9 or later to mitigate this vulnerability.
Other vulnerabilities in Enigmail
See all- CVE-2017-17847High
An issue was discovered in Enigmail before 1.9.9 related to signature spoofing. The UI does not properly distinguish between an attachment signature and a signature that applies to the entire containing message, which may lead to unauthorized message authentication.
- CVE-2017-17846High
An issue was discovered in Enigmail before 1.9.9 related to regular expressions that can be exploited for Denial of Service by attempting to match arbitrarily long strings.
- CVE-2017-17845High
An issue was discovered in Enigmail before 1.9.9 related to improper random secret generation. The use of Math.Random() by pretty Easy privacy (pEp) leads to this vulnerability.
Original NVD description (English source)
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.