CVE-2022-2226 Other in Thunderbird
Attackers can replay old signed emails to deceive victims into believing outdated statements are current due to missing date validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-2226?
CVE-2022-2226 is a medium-severity vulnerability in Mozilla Thunderbird, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.
Weakness: CWE-294
Which versions are affected by CVE-2022-2226?
It affects 1 product.
Products include Mozilla Thunderbird.
How do I fix CVE-2022-2226?
Upgrade to a fixed version.
Is CVE-2022-2226 being exploited?
There is no known exploitation of CVE-2022-2226 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Thunderbird
Sources
Also known as DEBIAN-CVE-2022-2226, GHSA-g426-wcxv-272f, UBUNTU-CVE-2022-2226.