CVE-2020-15685: Command Injection
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.12.0-1~deb10u1Fixed in 1:115.3.1-1~deb10u1Fixed in 1:102.13.1-1~deb11u1Fixed in 1:115.3.1-1~deb11u1Fixed in 1:102.15.1-1~deb12u1Fixed in 1:115.3.1-1~deb12u1Fixed in 1:115.3.1-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 78.7 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 78.7.0-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2020-15685?
CVE-2020-15685 has a medium severity level due to potential command injection vulnerabilities during the STARTTLS setup.
How do I fix CVE-2020-15685?
To fix CVE-2020-15685, upgrade to versions of Thunderbird that are not affected, specifically 78.7.0 or later.
Which versions of Thunderbird are affected by CVE-2020-15685?
CVE-2020-15685 affects Thunderbird versions prior to 78.7.0.
What type of vulnerability is CVE-2020-15685?
CVE-2020-15685 is a command injection vulnerability during the plaintext phase of the STARTTLS connection.
Is CVE-2020-15685 specific to any particular operating system?
CVE-2020-15685 primarily affects the Mozilla Thunderbird email client across various operating systems.