The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification

This update for enigmail to version 2.0.5 fixes the following issues :

Improvements on previous fixes on CVE-2017-17688, boo#1093151 and CVE-2017-17689, boo#1093152 (EFAIL) :

  - do not decrypt MIME parts unnecessarily 

  - improve Error Message for Missing Message Modification     Code

This update for enigmail fixes multiple issues.

Security issues fixed :

  - CVE-2017-17688: CFB gadget attacks allowed to exfiltrate     plaintext out of encrypted emails. enigmail now fails on     GnuPG integrity check warnings for old Algorithms     (bsc#1093151)

  - CVE-2017-17689: CBC gadget attacks allows to exfiltrate     plaintext out of encrypted emails (bsc#1093152)

Enigmail update to version 2.0.4, introduces fixes for the efail attack. Please check and modify your Thunderbird settings if required:
https://enigmail.net/index.php/en/home/news/66-2018-05-16-efail-vulner ability-affects-encrypted-mails

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for enigmail to version 2.0.4 fixes multiple issues.

Security issues fixed :

  - CVE-2017-17688: CFB gadget attacks allowed to exfiltrate     plaintext out of encrypted emails. enigmail now fails on     GnuPG integrity check warnings for old Algorithms     (bsc#1093151)

  - CVE-2017-17689: CBC gadget attacks allows to exfiltrate     plaintext out of encrypted emails (bsc#1093152)

This update also includes new and updated functionality :

  - The Encryption and Signing buttons now work for both     OpenPGP and S/MIME. Enigmail will chose between S/MIME     or OpenPGP depending on whether the keys for all     recipients are available for the respective standard

  - Support for the Autocrypt standard, which is now enabled     by default

  - Support for Pretty Easy Privacy (p&equiv;p)

  - Support for Web Key Directory (WKD)

  - The message subject can now be encrypted and replaced     with a dummy subject, following the Memory Hole standard     forprotected Email Headers

  - keys on keyring are automatically refreshed from     keyservers at irregular intervals

  - Subsequent updates of Enigmail no longer require a     restart of Thunderbird 

  - Keys are internally addressed using the fingerprint     instead of the key ID

ID	Name	Product	Family	Severity
123173	openSUSE Security Update : enigmail (openSUSE-2019-395) (EFAIL)	Nessus	SuSE Local Security Checks	medium
123172	openSUSE Security Update : enigmail (openSUSE-2019-368) (EFAIL)	Nessus	SuSE Local Security Checks	medium
120544	Fedora 28 : thunderbird-enigmail (2018-77fe2e20ad) (EFAIL)	Nessus	Fedora Local Security Checks	medium
110168	Fedora 26 : thunderbird-enigmail (2018-6020628437) (EFAIL)	Nessus	Fedora Local Security Checks	medium
110166	Fedora 27 : thunderbird-enigmail (2018-25525a9346) (EFAIL)	Nessus	Fedora Local Security Checks	medium
110068	openSUSE Security Update : enigmail (openSUSE-2018-495) (EFAIL)	Nessus	SuSE Local Security Checks	medium
109933	openSUSE Security Update : enigmail (openSUSE-2018-474) (EFAIL)	Nessus	SuSE Local Security Checks	medium
109904	openSUSE Security Update : enigmail (openSUSE-2018-470) (EFAIL)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2017-17688

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium