Rapid7 Vulnerability & Exploit Database

Amazon Linux AMI 2: CVE-2022-1834: Security patch for thunderbird (ALAS-2022-1828)

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

Amazon Linux AMI 2: CVE-2022-1834: Security patch for thunderbird (ALAS-2022-1828)

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
09/30/2022
Created
09/30/2022
Added
09/30/2022
Modified
01/04/2023

Description

When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10.

Solution(s)

  • amazon-linux-ami-2-upgrade-thunderbird
  • amazon-linux-ami-2-upgrade-thunderbird-debuginfo

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;