CVE-2017-7229 Information disclosure in n/a
Attackers can force encrypted emails to be resent in plaintext by corrupting MIME headers, leading to information disclosure and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-7229?
CVE-2017-7229 is a critical vulnerability in n/a, published on 3 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PGP/MIME encrypted messages injected into a Vaultive O365 (before 4.5.21) frontend via IMAP or SMTP have their Content-Type changed from 'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted"; boundary="abc123abc123"' to 'Content-Type: text/plain' - this results in the encrypted message being structured in such a way that most PGP/MIME-capable mail user agents are unable to decrypt it cleanly. The outcome is that encrypted mail passing through this device does not work (Denial of Service), and a common real-world consequence is a request to resend the mail in the clear (Information Disclosure).
Weakness: CWE-326
Which versions are affected by CVE-2017-7229?
It affects 1 product.
Products include Vaultive Office 365 Security.
How do I fix CVE-2017-7229?
No fix has been published for CVE-2017-7229 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-7229 being exploited?
There is no known exploitation of CVE-2017-7229 in the wild and no public exploit code.
Sources
Also known as GHSA-qwjq-mwf2-6fjf.