CVE-2017-17689

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/104165Third Party Advisory, VDB Entry
https://efail.deExploit, Mitigation, Third Party Advisory
https://news.ycombinator.com/item?id=17066419Issue Tracking, Third Party Advisory
https://pastebin.com/gNCc8aYmThird Party Advisory
https://twitter.com/matthew_d_green/status/996371541591019520Third Party Advisory
https://www.synology.com/support/security/Synology_SA_18_22Third Party Advisory
http://www.securityfocus.com/bid/104165Third Party Advisory, VDB Entry
https://efail.deExploit, Mitigation, Third Party Advisory
https://news.ycombinator.com/item?id=17066419Issue Tracking, Third Party Advisory
https://pastebin.com/gNCc8aYmThird Party Advisory
https://twitter.com/matthew_d_green/status/996371541591019520Third Party Advisory
https://www.synology.com/support/security/Synology_SA_18_22Third Party Advisory

Timeline

Published: May 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-17698.8IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthor CVE-2017-176918.1Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client CVE-2017-176927.5Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted Java CVE-2017-176934.3Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remo CVE-2017-176945.4Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.CVE-2017-176958.8Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.CVE-2017-176964.3Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php.CVE-2017-176978.6The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping.CVE-2017-176986.1Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec.CVE-2017-176999.8K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request.CVE-2017-177009.8K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request.CVE-2017-177019.8K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request.