CVE-2021-23969: Medium severity Mozilla Thunderbird vulnerability
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin.
Other sources
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Thunderbird incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.12.0-1~deb10u1Fixed in 1:115.3.1-1~deb10u1Fixed in 1:102.13.1-1~deb11u1Fixed in 1:115.3.1-1~deb11u1Fixed in 1:102.15.1-1~deb12u1Fixed in 1:115.3.1-1~deb12u1Fixed in 1:115.3.1-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 78.8 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 86 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 78.8 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 87.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 78.8.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 87.0-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 78.9.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2021-23969?
CVE-2021-23969 is considered a moderate severity vulnerability.
How do I fix CVE-2021-23969?
To fix CVE-2021-23969, update your affected software to the recommended versions such as Firefox 118.0.2-1 or Firefox ESR versions specified in the vulnerability description.
Which software is affected by CVE-2021-23969?
CVE-2021-23969 affects Mozilla Firefox, Firefox ESR, and Thunderbird on Debian systems.
What type of vulnerability is CVE-2021-23969?
CVE-2021-23969 is related to Content Security Policy, specifically concerning violation report handling.
Is there a workaround for CVE-2021-23969?
There is no known effective workaround for CVE-2021-23969 other than applying the appropriate software updates.