CVE-2020-12398: High severity Mozilla Thunderbird vulnerability
If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-12398?
CVE-2020-12398 is a vulnerability in Thunderbird where, if it is configured to use STARTTLS for an IMAP server and the server sends a PREAUTH response, Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection.
What is the severity of CVE-2020-12398?
CVE-2020-12398 has a severity rating of high.
How does CVE-2020-12398 affect Thunderbird?
CVE-2020-12398 affects Thunderbird version 68.9, where if configured to use STARTTLS for an IMAP server and the server sends a PREAUTH response, Thunderbird will continue with an unencrypted connection.
How can I fix CVE-2020-12398 in Thunderbird?
To fix CVE-2020-12398 in Thunderbird, you should update to a version that includes the necessary security patches. The recommended version is 68.9 or later. Please refer to the Mozilla Thunderbird website or vendor for the latest updates.
Where can I find more information about CVE-2020-12398?
You can find more information about CVE-2020-12398 on the Mozilla Bugzilla page (https://bugzilla.mozilla.org/show_bug.cgi?id=1613623) and the Mozilla Security Advisories page (https://www.mozilla.org/en-US/security/advisories/mfsa2020-22/).