CVE-2021-23991
Publication date 13 April 2021
Last updated 24 July 2024
Ubuntu priority
If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might subsequently attempt to use the invalid subkey, and will fail to send encrypted email to Alice. This vulnerability affects Thunderbird < 78.9.1.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| thunderbird | ||
| 22.04 LTS jammy |
Fixed 1:78.11.0+build1-0ubuntu2
|
|
| 20.04 LTS focal |
Fixed 1:78.11.0+build1-0ubuntu0.20.04.2
|
|
| 18.04 LTS bionic |
Fixed 1:78.11.0+build1-0ubuntu0.18.04.2
|
|
| 16.04 LTS xenial | Ignored end of standard support, was needs-triage | |
| 14.04 LTS trusty | Not in release |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
6.8 · Medium
|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-4995-1
- Thunderbird vulnerabilities
- 22 June 2021
- USN-4995-2
- Thunderbird vulnerabilities
- 25 June 2021