CVE-2021-23992

Katalog CVE

CVSS 4.3 · Medium EPSS 0,48%

Kerentanan Improper Verification of Cryptographic Signature pada mozilla thunderbird. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird < 78.9.1.

Rincian

Terbit di NVD

24 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1666236 issue tracking · permissions required · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2021-13/ release notes · advisory vendor