CVE Vulnerability

CVE-2021-23993

An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail. This vulnerability affects Thunderbird < 78.9.1.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1666360 Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2021-13/ Release Notes Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Information

Published : 2021-06-24 02:15

Updated : 2021-07-06 06:47

NVD link : CVE-2021-23993

Mitre link : CVE-2021-23993

Products Affected
No products.
CWE
CWE-327