Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird < 102.7.1.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbird | Feb 9, 2023 | Feb 6, 2023 |
| Amazon Linux Ami 2 | — | Upgrade thunderbird-debuginfoUpgrade thunderbird | May 28, 2024 | Jun 2, 2023 |
| Centos_linux | — | Upgrade thunderbird-debuginfoUpgrade thunderbird | Feb 8, 2023 | Feb 6, 2023 |
| Debian | — | Upgrade thunderbird | Feb 21, 2023 | Feb 21, 2023 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 102.7.1 | Feb 2, 2023 | Jan 23, 2023 |
| Oracle_linux | — | Upgrade thunderbird | Feb 7, 2023 | Jan 23, 2023 |
| Redhat_linux | — | No solution existsUpgrade thunderbird-debugsourceUpgrade thunderbirdUpgrade thunderbird-debuginfo | Feb 8, 2023 | Feb 6, 2023 |
| Rocky_linux | — | Upgrade thunderbirdUpgrade thunderbird-debuginfoUpgrade thunderbird-debugsource | Mar 12, 2024 | Jun 2, 2023 |
| Suse | — | Upgrade MozillaThunderbirdUpgrade MozillaThunderbird-translations-commonUpgrade MozillaThunderbird-translations-other | Feb 13, 2023 | Feb 9, 2023 |
| Ubuntu | — | Upgrade thunderbird | Mar 22, 2023 | Feb 6, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub