CVE-2017-7229
CriticalSummary
Vaultive O365 versions before 4.5.21 have an issue with handling PGP/MIME messages injected via IMAP or SMTP. The change in Content-Type header causes most mail user agents to be unable to decrypt the message correctly, leading to a denial of service.
Risk Assessment
The organization may face communication issues as encrypted messages are not delivered correctly, potentially resulting in information disclosure through requests to resend messages in clear text.
Recommendation
It is recommended to upgrade to Vaultive O365 version 4.5.21 or later to mitigate this vulnerability and ensure proper functioning of encrypted messages.
Original NVD description (English source)
PGP/MIME encrypted messages injected into a Vaultive O365 (before 4.5.21) frontend via IMAP or SMTP have their Content-Type changed from 'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted"; boundary="abc123abc123"' to 'Content-Type: text/plain' - this results in the encrypted message being structured in such a way that most PGP/MIME-capable mail user agents are unable to decrypt it cleanly. The outcome is that encrypted mail passing through this device does not work (Denial of Service), and a common real-world consequence is a request to resend the mail in the clear (Information Disclosure).