CVE-2017-17848

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-12-27 · updated 2026-06-17
Weakness: CWE-347

Description

An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.

Affected products

Debian Linux: 7.0, 8.0, 9.0
Enigmail: before 1.9.9 — fixed in 1.9.9

How to fix

Upgrade to a fixed version: Enigmail 1.9.9. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
http://seclists.org/fulldisclosure/2019/Apr/38
http://www.openwall.com/lists/oss-security/2019/04/30/4
https://github.com/RUB-NDS/Johnny-You-Are-Fired
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html
https://lists.debian.org/debian-security-announce/2017/msg00333.html
https://sourceforge.net/p/enigmail/bugs/709/
https://www.debian.org/security/2017/dsa-4070
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
http://seclists.org/fulldisclosure/2019/Apr/38
http://www.openwall.com/lists/oss-security/2019/04/30/4

Get alerted when CVE-2017-17848 or the next vulnerability affects your stack