CVE-2021-23993 Denial of service in Thunderbird
An attacker can cause denial of service in Thunderbird by crafting an OpenPGP key with an invalid self signature, preventing encrypted email sending.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-23993?
CVE-2021-23993 is a medium-severity denial of service vulnerability in Mozilla Thunderbird, published on 24 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail. This vulnerability affects Thunderbird < 78.9.1.
Weakness: CWE-347
Which versions are affected by CVE-2021-23993?
It affects 1 product.
Products include Mozilla Thunderbird.
How do I fix CVE-2021-23993?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-23993 being exploited?
There is no known exploitation of CVE-2021-23993 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Thunderbird
Sources
Also known as DEBIAN-CVE-2021-23993, GHSA-3pj2-rvj5-6646, UBUNTU-CVE-2021-23993.