CVE-2021-4126: Medium severity Mozilla Thunderbird vulnerability
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the additional contents were also covered by the digital signature. Starting with Thunderbird version 91.4.1, only the signature that belongs to the top level MIME part will be considered for the displayed status.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.12.0-1~deb10u1Fixed in 1:115.3.1-1~deb10u1Fixed in 1:102.13.1-1~deb11u1Fixed in 1:115.3.1-1~deb11u1Fixed in 1:102.15.1-1~deb12u1Fixed in 1:115.3.1-1~deb12u1Fixed in 1:115.3.1-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 91.4.1 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.4.1-r0
Event History
Frequently Asked Questions
What is CVE-2021-4126?
CVE-2021-4126 is a vulnerability in Thunderbird that allows an attacker to bypass signature verification on OpenPGP/MIME signed email messages.
How does CVE-2021-4126 affect Thunderbird?
CVE-2021-4126 affects Thunderbird when receiving an OpenPGP/MIME signed email message with an additional outer MIME message layer.
What is the severity of CVE-2021-4126?
CVE-2021-4126 has a severity rating of medium.
How can an attacker exploit CVE-2021-4126?
An attacker can exploit CVE-2021-4126 by adding an additional outer MIME message layer to an OpenPGP/MIME signed email message.
Is there a fix for CVE-2021-4126?
Yes, the fix for CVE-2021-4126 is included in Thunderbird version 91.4.1 and later.