CVE-2023-0430: Medium severity Mozilla Thunderbird vulnerability

Q: What is the severity of CVE-2023-0430?

CVE-2023-0430 has been classified as a high severity vulnerability due to the risk of displaying a valid signature for emails signed with revoked certificates.

Q: How do I fix CVE-2023-0430?

To fix CVE-2023-0430, upgrade to Thunderbird version 102.7.1 or later.

Q: Which versions of Thunderbird are affected by CVE-2023-0430?

CVE-2023-0430 affects Thunderbird versions from 68.0 up to, but not including, 102.7.1.

Q: What impact does CVE-2023-0430 have on email security?

CVE-2023-0430 undermines email security by allowing emails signed with revoked certificates to appear as valid, potentially leading to trust issues.

Q: Is the OCSP check really important in CVE-2023-0430?

Yes, the OCSP check is critical for verifying the revocation status of certificates to ensure the integrity of email signatures.

Published Jan 23, 2023

Updated

Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug.

Affected Software

3 affected componentsFixes available

Mozilla Thunderbird<102.7.1

102.7.1

Mozilla Thunderbird>=68.0<102.7.1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u21:140.12.0esr-1~deb13u11:153.6.0esr-1~deb13u11:153.5.0esr-11:153.6.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.3.1-1~deb10u1Fixed in 1:102.13.1-1~deb11u1Fixed in 1:115.3.1-1~deb11u1Fixed in 1:102.15.1-1~deb12u1Fixed in 1:115.3.1-1~deb12u1Fixed in 1:115.3.1-1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 102.7.1

Event History

Jan 23, 2023

CVE Published

12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

Jun 2, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

05:15 PM

Description

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2023-0430?

CVE-2023-0430 has been classified as a high severity vulnerability due to the risk of displaying a valid signature for emails signed with revoked certificates.

How do I fix CVE-2023-0430?

To fix CVE-2023-0430, upgrade to Thunderbird version 102.7.1 or later.

Which versions of Thunderbird are affected by CVE-2023-0430?

CVE-2023-0430 affects Thunderbird versions from 68.0 up to, but not including, 102.7.1.

What impact does CVE-2023-0430 have on email security?

CVE-2023-0430 undermines email security by allowing emails signed with revoked certificates to appear as valid, potentially leading to trust issues.

Is the OCSP check really important in CVE-2023-0430?

Yes, the OCSP check is critical for verifying the revocation status of certificates to ensure the integrity of email signatures.

CVE-2023-0430: Medium severity Mozilla Thunderbird vulnerability

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2023-0430?

How do I fix CVE-2023-0430?

Which versions of Thunderbird are affected by CVE-2023-0430?

What impact does CVE-2023-0430 have on email security?

Is the OCSP check really important in CVE-2023-0430?

Company

Resources

Contact