CVE-2021-23993

NameCVE-2021-23993
DescriptionAn attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail. This vulnerability affects Thunderbird < 78.9.1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2632-1, DSA-4897-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
thunderbird (PTS)bullseye1:115.12.0-1~deb11u1fixed
bullseye (security)1:115.16.0esr-1~deb11u1fixed
bookworm1:115.12.0-1~deb12u1fixed
bookworm (security)1:115.16.0esr-1~deb12u1fixed
trixie1:128.2.0esr-1fixed
sid1:128.3.0esr-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
thunderbirdsourcestretch1:78.10.0-1~deb9u1DLA-2632-1
thunderbirdsourcebuster1:78.10.0-1~deb10u1DSA-4897-1
thunderbirdsource(unstable)1:78.10.0-1

Notes

https://www.mozilla.org/en-US/security/advisories/mfsa2021-13/#CVE-2021-23993

Search for package or bug name: Reporting problems