The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification
Name | Vendor | Start Version | End Version |
---|---|---|---|
Apple | - (including) | - (including) | |
Airmail | Bloop | - (including) | - (including) |
Emclient | Emclient | - (including) | - (including) |
Maildroid | Flipdogsolutions | - (including) | - (including) |
Mailmate | Freron | - (including) | - (including) |
Horde_imp | Horde | - (including) | - (including) |
Outlook | Microsoft | 2007 (including) | 2007 (including) |
Thunderbird | Mozilla | - (including) | - (including) |
Postbox | Postbox-inc | - (including) | - (including) |
R2mail2 | R2mail2 | - (including) | - (including) |
Webmail | Roundcube | - (including) | - (including) |
Enigmail | Ubuntu | artful | * |
Enigmail | Ubuntu | trusty | * |
Enigmail | Ubuntu | upstream | * |