CVE-2022-2226
First published: Tue Jun 28 2022(Updated: )
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Thunderbird | <102 | 102 |
| Thunderbird | <91.11 | 91.11 |
| Thunderbird | <91.11 | |
| Thunderbird | =101.0 | |
| <91.11 | ||
| =101.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the severity of CVE-2022-2226?
The severity of CVE-2022-2226 is rated as moderate.
How do I fix CVE-2022-2226?
To fix CVE-2022-2226, you should update Thunderbird to version 102.0 or later.
What versions of Thunderbird are affected by CVE-2022-2226?
CVE-2022-2226 affects Thunderbird versions up to 102.0 and versions 91.11 and below.
What type of vulnerability is CVE-2022-2226?
CVE-2022-2226 is a vulnerability related to digital signature validation in email messages.
Can CVE-2022-2226 lead to security breaches?
Yes, CVE-2022-2226 can potentially allow attackers to exploit invalid signatures without detection.
- agent/type
- agent/first-publish-date
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/description
- agent/event
- agent/trending
- agent/source
- collector/mozilla-advisory
- agent/software-canonical-lookup-request
- source/Mozilla
- agent/software-canonical-lookup
- collector/nvd-index
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- vendor/mozilla
- canonical/thunderbird
- version/thunderbird/101.0