Filter by Category

GoAnywhere MFT Not Affected by EFAIL Vulnerabilities

goanywhere MFT already prevents EFAIL vulnerabilities

Ashland, NE, May 16, 2018

In light of the recent Open PGP & S/MIME warning (EFAIL), GoAnywhere has performed a software security review of its managed file transfer solution to ensure customers and their encrypted emails are not affected by this vulnerability. The review was positive and demonstrates that GoAnywhere MFT is already protected from EFAIL.

The EFAIL warning identifies a weakness with encrypted emails and how secure content can be exfiltrated. The weakness can be further exploited by using the CBC/CFB gadget attack on Open PGP encrypted MIME parts. An attacker may intercept and alter an encrypted email and add specially crafted HTML MIME parts, which causes vulnerable email clients to send decrypted data to an external party.

While GoAnywhere MFT can process Open PGP encrypted files, it does not support Open PGP encrypted emails. GoAnywhere is not affected by the CBC/CFB gadget attack on Open PGP and S/MIME. Instead, the software uses standard SSL/TLS to decrypt email messages. When messages are retrieved from a mail server, GoAnywhere maintains a separation between MIME parts, writing each part to their own unique file.

Additionally, the software does not evaluate or render HTML emails, mitigating the risk of a direct exfiltration attack.

The GoAnywhere team is dedicated to the continued stability and security of its products. Further security reviews will be performed as new information is published.

Latest Posts


How to Comply with Brazil's Lei Geral de Proteção de Dados (LGPD)

January 14, 2021

What is Brazil’s LGPD?LGPD stands for Lei Geral de Proteção de Dados (General Data Protection Law), which is a law streamlining what was previously 40 separate statutes protecting personal data…


What is SSL, TLS, and HTTPS?

January 13, 2021

Meet the Trio SSL, TLS, and HTTPS are a unique trio that each work to help keep your important data secure on the Internet. If you've ever wondered how each of these protocols compares, you’ve…


Is FTPS or SFTP More Secure?

January 12, 2021

FTPS vs. SFTP – Level of Security FTPS and SFTP are two of the mainstream protocols for transferring your sensitive files, but they are not 100 percent equal when it comes to their level of…


What is the LGPD? Meet Brazil’s New Powerful Data Protection Law

January 8, 2021

What is the LGPD? The LGPD is the new overarching law for the protection of personal data in Brazil (see details below for its full scope). Brazil’s parliament passed the LGPD as Law # 13,709 on…