CVE-2021-29956

Publication date 28 May 2021

Last updated 24 July 2024


Ubuntu priority

Cvss 3 Severity Score

4.3 · Medium

Score breakdown

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird < 78.10.2.

Status

Package Ubuntu Release Status
thunderbird 23.04 lunar
Fixed 1:78.11.0+build1-0ubuntu2
22.10 kinetic
Fixed 1:78.11.0+build1-0ubuntu2
22.04 LTS jammy
Fixed 1:78.11.0+build1-0ubuntu2
21.10 impish
Fixed 1:78.11.0+build1-0ubuntu2
21.04 hirsute
Fixed 1:78.11.0+build1-0ubuntu0.21.04.2
20.10 groovy
Fixed 1:78.11.0+build1-0ubuntu0.20.10.2
20.04 LTS focal
Fixed 1:78.11.0+build1-0ubuntu0.20.04.2
18.04 LTS bionic
Fixed 1:78.11.0+build1-0ubuntu0.18.04.2
16.04 LTS xenial Ignored end of standard support
14.04 LTS trusty Not in release

Severity score breakdown

Parameter Value
Base score 4.3 · Medium
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality Low
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

Related Ubuntu Security Notices (USN)

    • USN-4995-1
    • Thunderbird vulnerabilities
    • 22 June 2021
    • USN-4995-2
    • Thunderbird vulnerabilities
    • 25 June 2021

Other references