CVE-2023-0547: Medium severity Mozilla Thunderbird vulnerability
Last updated 24 July 2024
Other sources
OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:115.15.0-1~deb11u1Fixed in 1:115.12.0-1~deb12u1Fixed in 1:115.15.0-1~deb12u1Fixed in 1:128.2.0esr-1Fixed in 1:128.3.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 102.10
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-0547.
Which software is affected by this vulnerability?
Thunderbird versions from 68 to 102.9.1 are affected by this vulnerability.
What is the severity of CVE-2023-0547?
The severity of CVE-2023-0547 is high with a severity value of 7.
How does CVE-2023-0547 affect Thunderbird?
CVE-2023-0547 affects Thunderbird by not checking the OCSP revocation status of recipient certificates when sending S/Mime encrypted email, allowing revoked certificates to be accepted.
How can I fix CVE-2023-0547?
To fix CVE-2023-0547, update Thunderbird to version 102.10 or later.