CVE-2021-23992
MEDIUMThunderbird < 78.9.1 - OpenPGP Key User ID Spoofing via Invalid Self Signature
Title source: llmDescription
Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird < 78.9.1.
References (2)
Core 2
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://www.mozilla.org/security/advisories/mfsa2021-13/
Issue Tracking, Permissions Required, Vendor Advisory x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=1666236
Scores
CVSS v3
4.3
EPSS
0.0009
EPSS Percentile
24.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Details
CWE
CWE-347
Status
published
Products (1)
mozilla/thunderbird
< 78.9.1
Published
Jun 24, 2021
Tracked Since
Feb 18, 2026