CVE-2021-4126
First published: Tue Dec 21 2021(Updated: )
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the additional contents were also covered by the digital signature. Starting with Thunderbird version 91.4.1, only the signature that belongs to the top level MIME part will be considered for the displayed status.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Thunderbird | <91.4.1 | 91.4.1 |
| <91.4.1 | 91.4.1 | |
| Mozilla Thunderbird | <91.4.1 | |
| debian/thunderbird | 1:91.12.0-1~deb10u1 1:115.3.1-1~deb10u1 1:102.13.1-1~deb11u1 1:115.3.1-1~deb11u1 1:102.15.1-1~deb12u1 1:115.3.1-1~deb12u1 1:115.3.1-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1732310
- https://www.mozilla.org/en-US/security/advisories/mfsa2021-55/
- https://www.mozilla.org/security/advisories/mfsa2021-55/
- https://www.mozilla.org/en-US/security/advisories/mfsa2021-55/#CVE-2021-4126
- https://security-tracker.debian.org/tracker/CVE-2021-4126
Frequently Asked Questions
What is CVE-2021-4126?
CVE-2021-4126 is a vulnerability in Thunderbird that allows an attacker to bypass signature verification on OpenPGP/MIME signed email messages.
How does CVE-2021-4126 affect Thunderbird?
CVE-2021-4126 affects Thunderbird when receiving an OpenPGP/MIME signed email message with an additional outer MIME message layer.
What is the severity of CVE-2021-4126?
CVE-2021-4126 has a severity rating of medium.
How can an attacker exploit CVE-2021-4126?
An attacker can exploit CVE-2021-4126 by adding an additional outer MIME message layer to an OpenPGP/MIME signed email message.
Is there a fix for CVE-2021-4126?
Yes, the fix for CVE-2021-4126 is included in Thunderbird version 91.4.1 and later.
- collector/security-tracker-debian
- collector/nvd-index
- collector/mozilla-advisory
- vendor/mozilla
- vendor/thunderbird
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- source/Mozilla
- agent/software-canonical-lookup
- agent/author
- agent/severity
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- agent/trending
- package-manager/debian
- canonical/mozilla thunderbird