Draft paper linked from efail.de.
TL;DR: the vulnerability is in some popular email client softwares, typically combined with an extension simplifying use of GnuPG (or other OpenPGP implementations) within said software; e.g. an extension bundled in popular distributions of GnuPG v2, thus common.
The issue is that un-validated deciphered ciphertext is made available to the email client, which acts upon it (e.g. following HTML links), giving a decryption oracle.
Disabling encryption functionality in the email client and getting back to manual use of the bare OpenPGP tool should be fine (for those implementing Modification Detection Code and if the warnings emitted when it is absent or fails to check are properly acted upon; feeding what's piped out to a vulnerable software could be bad). If I used GnuPG (I do) within my email client (I don't), I would disable whatever extension (or built-in option) allows that, until it is checked or improved to suppress deciphered plaintext that did not pass the MDC test.
From an official statement by the GnuPG and Gpg4Win teams:
- This paper is misnamed. It's not an attack on OpenPGP. It's an attack on broken email clients that ignore GnuPG's warnings and do silly things after being warned. 2. This attack targets buggy email clients. Correct use of the MDC completely prevents this attack. GnuPG has had MDC support since the summer of 2000.