PT-2021-22165 · Mozilla+8 · Thunderbird+8

Mattias Jacobsson · Published 2021-10-06 · Updated 2022-07-12 · CVE-2021-38502

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 91.2

Description The issue allows a man-in-the-middle (MITM) to perform a downgrade attack, intercepting transmitted messages or taking control of the authenticated session to execute chosen SMTP commands. If an unprotected authentication method is used, the MITM could also obtain authentication credentials.

Recommendations For versions prior to 91.2, update to version 91.2 or later to resolve the issue. As a temporary workaround, consider configuring SMTP connections to use protected authentication methods and STARTTLS security to minimize the risk of exploitation. Restrict access to SMTP commands to prevent unauthorized execution until the issue is resolved.

Fix

Related Identifiers

ALT-PU-2021-2992

ALT-PU-2021-3004

ALT-PU-2021-3097

ALT-PU-2021-3118

ALT-PU-2021-3370

ALT-PU-2022-1783

CESA-2021_3838

CESA-2021_3841

CVE-2021-38502

DLA-2874-1

DSA-5034-1

MGASA-2021-0478

OPENSUSE-SU-2021:1635-1

OPENSUSE-SU-2021:4150-1

OPENSUSE-SU-2021_1635-1

OPENSUSE-SU-2021_4150-1

RHSA-2021:3838

RHSA-2021:3839

RHSA-2021:3840

RHSA-2021:3841

RHSA-2021_3838

RHSA-2021_3841

RLSA-2021:3838

SUSE-SU-2021:4150-1

USN-5248-1

Affected Products

Alt Linux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Thunderbird

Ubuntu

References · 123

• https://ubuntu.com/security/CVE-2021-43545 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43534 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-22747 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-22738 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38497 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-4126 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-22737 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38496 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38501 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43539 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-22748 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5248-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38503 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43535 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38507 · Vendor Advisory