CVE-2021-23993: Medium severity thunderbird vulnerability
An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2021-23993?
CVE-2021-23993 has been classified as a moderate severity vulnerability.
How do I fix CVE-2021-23993?
To fix CVE-2021-23993, update Thunderbird to version 78.9.1 or later.
What type of attack does CVE-2021-23993 enable?
CVE-2021-23993 allows an attacker to perform a Denial of Service (DoS) attack.
Which software versions are affected by CVE-2021-23993?
CVE-2021-23993 affects Thunderbird versions prior to 78.9.1.
What is the impact of exploiting CVE-2021-23993?
Exploiting CVE-2021-23993 can prevent users from sending encrypted emails.