CVE-2021-29956: Medium severity thunderbird vulnerability
OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29956?
The severity of CVE-2021-29956 is considered high due to the exposure of unencrypted OpenPGP secret keys.
How do I fix CVE-2021-29956?
To fix CVE-2021-29956, update to Mozilla Thunderbird version 78.10.2 or later.
What are the risks associated with CVE-2021-29956?
The risks of CVE-2021-29956 include unauthorized access to sensitive cryptographic keys stored unencrypted on local disks.
Who is affected by CVE-2021-29956?
Users of Mozilla Thunderbird versions 78.8.1 through 78.10.1 who imported OpenPGP secret keys are affected by CVE-2021-29956.
What has changed in Thunderbird with the fix for CVE-2021-29956?
The fix for CVE-2021-29956 re-enables the master password protection mechanism for newly imported OpenPGP keys.