PT-2021-2667 · Mozilla+7 · Thunderbird+7

Neal Walfield · Published 2021-04-08 · Updated 2021-07-08 · CVE-2021-23992

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 78.9.1

Description: The issue is related to the incorrect verification of OpenPGP key signatures. An attacker can create a crafted OpenPGP key by replacing or adding a user ID. If the crafted key is imported and accepted, the user may incorrectly assume the false user ID belongs to the correspondent. This allows a remote attacker to access protected information.

Recommendations: For versions prior to 78.9.1, update to version 78.9.1 or later to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

ALT-PU-2021-1804

ALT-PU-2021-1886

ALT-PU-2021-1892

BDU:2021-02196

CESA-2021_1192

CESA-2021_1193

CVE-2021-23992

DLA-2632-1

DSA-4897-1

MGASA-2021-0189

OPENSUSE-SU-2021:0580-1

OPENSUSE-SU-2021_0580-1

RHSA-2021:1190

RHSA-2021:1192

RHSA-2021:1193

RHSA-2021:1201

RHSA-2021_1192

RHSA-2021_1193

SUSE-SU-2021:1167-1

USN-4995-1

USN-4995-2

Affected Products

Alt Linux

Astra Linux

Centos

Linuxmint

Red Hat

Suse

Thunderbird

Ubuntu

References · 62

• https://ubuntu.com/security/CVE-2021-29946 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2632-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23981 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23993 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23961 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23999 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4897-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29967 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23984 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0580-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1167-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23995 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23992 · Security Note
• https://osv.dev/vulnerability/USN-4995-2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-23992 · Vendor Advisory