Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2021-4126

Published: 24 December 2021

When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the additional contents were also covered by the digital signature. Starting with Thunderbird version 91.4.1, only the signature that belongs to the top level MIME part will be considered for the displayed status. This vulnerability affects Thunderbird < 91.4.1.

Priority

Medium

CVSS 3 base score: 6.5

Status

Package Release Status
thunderbird
Launchpad, Ubuntu, Debian
bionic
Released (1:91.5.0+build1-0ubuntu0.18.04.1)
focal
Released (1:91.5.0+build1-0ubuntu0.20.04.1)
hirsute Ignored
(reached end-of-life)
impish
Released (1:91.5.0+build1-0ubuntu0.21.10.1)
jammy
Released (1:91.5.0+build1-0ubuntu1)
kinetic
Released (1:91.5.0+build1-0ubuntu1)
trusty Ignored
(out of standard support)
upstream
Released (91.4.1)
xenial Needs triage