CVE-2021-38507: Medium severity Mozilla Thunderbird vulnerability
The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on port 80. However, if a second encrypted port on the same IP address (e.g. port 8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin with HTTP. This was resolved by disabling the Opportunistic Encryption feature, which had low usage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1Fixed in 115.4.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.12.0-1~deb10u1Fixed in 1:115.3.1-1~deb10u1Fixed in 1:102.13.1-1~deb11u1Fixed in 1:115.3.1-1~deb11u1Fixed in 1:102.15.1-1~deb12u1Fixed in 1:115.3.1-1~deb12u1Fixed in 1:115.3.1-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 91.3 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 94 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 91.3 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 94.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 91.3.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 94.0-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.3.2-r0 - Configuration
Disable the Opportunistic Encryption feature.
Firefox/Thunderbird Opportunistic Encryption = disabled
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2021-38507?
CVE-2021-38507 is a vulnerability in the Opportunistic Encryption feature of HTTP2 that allows a connection to be upgraded to TLS while retaining the visual properties of an HTTP connection.
Which software is affected by CVE-2021-38507?
CVE-2021-38507 affects Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, and Debian Linux.
What is the severity of CVE-2021-38507?
CVE-2021-38507 has a severity rating of 6.5 (high).
How can I fix CVE-2021-38507?
To fix CVE-2021-38507, it is recommended to update to the latest version of the affected software.
Where can I find more information about CVE-2021-38507?
You can find more information about CVE-2021-38507 in the references provided: Bugzilla, Mozilla Security Advisories, and Debian LTS Announce.