CVE-2020-12421: Medium severity Mozilla Firefox vulnerability
Last updated 25 August 2025
Other sources
When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 68.10 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 78 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 78 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 68.10 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 149.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 140.9.1esr-1~deb11u1Fixed in 128.14.0esr-1~deb12u1Fixed in 140.9.1esr-1~deb12u1Fixed in 140.8.0esr-1~deb13u1Fixed in 140.9.1esr-1~deb13u1Fixed in 140.9.1esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.9.1esr-1~deb11u1Fixed in 1:140.6.0esr-1~deb12u1Fixed in 1:140.9.1esr-1~deb12u1Fixed in 1:140.8.0esr-1~deb13u1Fixed in 1:140.9.1esr-1~deb13u1Fixed in 1:140.9.0esr-1Fixed in 1:140.9.1esr-1 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 78.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 68.10.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 78.0-r0 - Upgrade
Upgrade
alpine/mozjs68to a version that resolves this vulnerability.Fixed in 68.10.0-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 68.10.0-r0 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 68.10.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-12421?
CVE-2020-12421 is a vulnerability that affects Mozilla Firefox and Thunderbird.
How does CVE-2020-12421 affect add-on updates?
CVE-2020-12421 can cause add-on updates to fail if the certificate chain terminates in non-built-in-roots.
Which versions of Mozilla Firefox are affected by CVE-2020-12421?
Mozilla Firefox versions up to and excluding 78 are affected by CVE-2020-12421.
Which versions of Thunderbird are affected by CVE-2020-12421?
Thunderbird versions up to and excluding 68.10 and 78 are affected by CVE-2020-12421.
What is the severity rating of CVE-2020-12421?
CVE-2020-12421 has a severity rating of medium.
How can I fix the CVE-2020-12421 vulnerability?
Update your Mozilla Firefox or Thunderbird to a version that includes the fix provided by Mozilla.
Where can I find more information about CVE-2020-12421?
You can find more information about CVE-2020-12421 on the Mozilla website: [link].