CVE-2021-23993
Medium
Description
An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail. This vulnerability affects Thunderbird < 78.9.1.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Mozilla Thunderbird
PublishedJun 24, 2021
First seenJun 24, 2021
How to fix
Update
- mozilla thunderbird78.9.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla thunderbird | v < 78.9.1 | 78.9.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.