CVE-2017-17689: 9folders nine

CVSS: 5.9v3.0MediumModified

AliasesUBUNTU-CVE-2017-17689DEBIAN-CVE-2017-17689

Published 16-05-2018Last modified 05-08-2024

Vulnerability summary

CVE-2017-17689 is a medium (CVSS 5.9) vulnerability in 9folders nine. EPSS estimates a 4.22% chance of exploitation in the next 30 days, higher than 90.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

34/100

0100

Medium · default modelHow is this calculated?

CVSS score

5.9/10

010

Medium · v3.0 (NVD)

EPSS score

4.22%

0%100%

Low · -0.06 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 6 · Related 6

OPENSUSE-SU-2018:1329-1 OPENSUSE-SU-2018:1330-1 OPENSUSE-SU-2024:10736-1 USN-7729-1 USN-7730-1 USN-7731-1

Timeline

16-05-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.05.9v2.04.3

EPSS trend

Probability

4.22%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

-0.06 pp

From 4.29% on 19-09-2026

19-09-202619-10-2026

EPSS score

4.22%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (efail.de)
Maturity: unknown

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu4 products

kdepim< 4:4.13.3-0ubuntu0.2+esm1 | < 4:15.12.3-0ubuntu1.1+esm1
kf5-messagelib< 4:17.12.3-0ubuntu3+esm1
kmail< 4:17.12.3-0ubuntu1+esm1
thunderbird< 1:52.8.0+build1-0ubuntu0.14.04.1 | < 1:52.8.0+build1-0ubuntu0.16.04.1 | < 1:52.8.0+build1-0ubuntu0.18.04.1

Debian2 products