Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-23993

An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail. This vulnerability affects Thunderbird < 78.9.1.

Published

2021-06-24T14:15:09.257

Last Modified

2024-11-21T05:52:10.197

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-347

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mozilla	thunderbird	< 78.9.1	Yes

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1666360 Issue Tracking, Permissions Required, Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2021-13/ Release Notes, Vendor Advisory ([email protected])
https://bugzilla.mozilla.org/show_bug.cgi?id=1666360 Issue Tracking, Permissions Required, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2021-13/ Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)