CVE-2021-23993

Katalog CVE

CVSS 6.5 · Medium EPSS 0,42%

Kerentanan Improper Verification of Cryptographic Signature pada mozilla thunderbird. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail. This vulnerability affects Thunderbird < 78.9.1.

Rincian

Terbit di NVD

24 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1666360 issue tracking · permissions required · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2021-13/ release notes · advisory vendor