CVE-2021-23992 Other in Thunderbird
Thunderbird fails to validate OpenPGP key user ID signatures, allowing attackers to spoof identities and bypass cryptographic verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-23992?
CVE-2021-23992 is a medium-severity vulnerability in Mozilla Thunderbird, published on 24 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird < 78.9.1.
Weakness: CWE-347
Which versions are affected by CVE-2021-23992?
It affects 1 product.
Products include Mozilla Thunderbird.
How do I fix CVE-2021-23992?
Upgrade to a fixed version.
Is CVE-2021-23992 being exploited?
There is no known exploitation of CVE-2021-23992 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Thunderbird
Sources
Also known as DEBIAN-CVE-2021-23992, GHSA-x89c-f42w-ch2g, UBUNTU-CVE-2021-23992.