CVE-2021-29957: Medium severity Mozilla Thunderbird vulnerability
If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 78.10.2 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.3.2-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29957?
CVE-2021-29957 has a moderate severity level due to the potential for user confusion regarding the protection of email message parts.
How do I fix CVE-2021-29957?
To fix CVE-2021-29957, update Mozilla Thunderbird to version 78.10.2 or later.
What versions of Thunderbird are affected by CVE-2021-29957?
CVE-2021-29957 affects all versions of Mozilla Thunderbird prior to 78.10.2.
What types of attacks does CVE-2021-29957 expose users to?
CVE-2021-29957 could expose users to the risk of unprotected message parts being misinterpreted as secure content.
Can CVE-2021-29957 affect other email clients?
CVE-2021-29957 specifically affects Mozilla Thunderbird and does not directly apply to other email clients.