CVE-2021-4126: Medium severity thunderbird vulnerability
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the additional contents were also covered by the digital signature. Starting with Thunderbird version 91.4.1, only the signature that belongs to the top level MIME part will be considered for the displayed status.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-4126?
CVE-2021-4126 is a vulnerability in Thunderbird that allows an attacker to bypass signature verification on OpenPGP/MIME signed email messages.
How does CVE-2021-4126 affect Thunderbird?
CVE-2021-4126 affects Thunderbird when receiving an OpenPGP/MIME signed email message with an additional outer MIME message layer.
What is the severity of CVE-2021-4126?
CVE-2021-4126 has a severity rating of medium.
How can an attacker exploit CVE-2021-4126?
An attacker can exploit CVE-2021-4126 by adding an additional outer MIME message layer to an OpenPGP/MIME signed email message.
Is there a fix for CVE-2021-4126?
Yes, the fix for CVE-2021-4126 is included in Thunderbird version 91.4.1 and later.