Medium severity5.9NVD Advisory· Published Dec 27, 2017· Updated Jun 17, 2026

CVE-2017-17843

Description

An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Enigmail/Enigmail2 versions
cpe:2.3:a:enigmail:enigmail:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:enigmail:enigmail:*:*:*:*:*:*:*:*range: <1.9.9
- (no CPE)range: <1.9.9
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdfnvdVendor Advisory
lists.debian.org/debian-security-announce/2017/msg00333.htmlnvdThird Party Advisory
www.debian.org/security/2017/dsa-4070nvdThird Party Advisory
lists.debian.org/debian-lts-announce/2017/12/msg00021.htmlnvd
www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000