CVE-2022-1834 Security feature bypass in Thunderbird
Attackers can spoof sender addresses using Braille spaces to bypass digital signature validation in Thunderbird, misleading users about email authenticity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-1834?
CVE-2022-1834 is a medium-severity vulnerability in Mozilla Thunderbird, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10.
Weakness: CWE-295
Which versions are affected by CVE-2022-1834?
It affects 1 product.
Products include Mozilla Thunderbird.
How do I fix CVE-2022-1834?
Upgrade to a fixed version.
Is CVE-2022-1834 being exploited?
There is no known exploitation of CVE-2022-1834 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Thunderbird
Sources
Also known as DEBIAN-CVE-2022-1834, GHSA-qq6h-hx9q-4fxv, UBUNTU-CVE-2022-1834.