CVE-2022-1197 Security feature bypass in Thunderbird
Thunderbird fails to update revoked keys with specific compromise reasons, allowing attackers to bypass revocation checks and use compromised keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-1197?
CVE-2022-1197 is a medium-severity vulnerability in Mozilla Thunderbird, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8.
Weakness: CWE-295
Which versions are affected by CVE-2022-1197?
It affects 1 product.
Products include Mozilla Thunderbird.
How do I fix CVE-2022-1197?
Upgrade to a fixed version.
Is CVE-2022-1197 being exploited?
There is no known exploitation of CVE-2022-1197 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Thunderbird
Sources
Also known as DEBIAN-CVE-2022-1197, GHSA-h922-mv7w-mhm4, UBUNTU-CVE-2022-1197.