CVE-2020-12398: High severity Mozilla Thunderbird vulnerability
If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 68.9 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.9.1esr-1~deb11u1Fixed in 1:140.6.0esr-1~deb12u1Fixed in 1:140.9.1esr-1~deb12u1Fixed in 1:140.8.0esr-1~deb13u1Fixed in 1:140.9.1esr-1~deb13u1Fixed in 1:140.9.0esr-1Fixed in 1:140.9.1esr-1 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 68.9.0-r0 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 68.9.0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-12398?
CVE-2020-12398 is a vulnerability in Thunderbird where, if it is configured to use STARTTLS for an IMAP server and the server sends a PREAUTH response, Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection.
What is the severity of CVE-2020-12398?
CVE-2020-12398 has a severity rating of high.
How does CVE-2020-12398 affect Thunderbird?
CVE-2020-12398 affects Thunderbird version 68.9, where if configured to use STARTTLS for an IMAP server and the server sends a PREAUTH response, Thunderbird will continue with an unencrypted connection.
How can I fix CVE-2020-12398 in Thunderbird?
To fix CVE-2020-12398 in Thunderbird, you should update to a version that includes the necessary security patches. The recommended version is 68.9 or later. Please refer to the Mozilla Thunderbird website or vendor for the latest updates.
Where can I find more information about CVE-2020-12398?
You can find more information about CVE-2020-12398 on the Mozilla Bugzilla page (https://bugzilla.mozilla.org/show_bug.cgi?id=1613623) and the Mozilla Security Advisories page (https://www.mozilla.org/en-US/security/advisories/mfsa2020-22/).