Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was configured, the MITM could obtain the authentication credentials, too. This vulnerability affects Thunderbird < 91.2.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1733366 | Issue Tracking Permissions Required Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html | Mailing List Third Party Advisory |
| https://www.debian.org/security/2022/dsa-5034 | Issue Tracking Third Party Advisory |
| https://www.mozilla.org/security/advisories/mfsa2021-47/ | Vendor Advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1733366 | Issue Tracking Permissions Required Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html | Mailing List Third Party Advisory |
| https://www.debian.org/security/2022/dsa-5034 | Issue Tracking Third Party Advisory |
| https://www.mozilla.org/security/advisories/mfsa2021-47/ | Vendor Advisory |
Configurations
History
21 Nov 2024, 06:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.mozilla.org/show_bug.cgi?id=1733366 - Issue Tracking, Permissions Required, Vendor Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2022/01/msg00001.html - Mailing List, Third Party Advisory | |
| References | () https://www.debian.org/security/2022/dsa-5034 - Issue Tracking, Third Party Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2021-47/ - Vendor Advisory |
Information
Published : 2021-11-03 01:15
Updated : 2024-11-21 06:17
NVD link : CVE-2021-38502
Mitre link : CVE-2021-38502
CVE.ORG link : CVE-2021-38502
JSON object : View
Products Affected
debian
- debian_linux
mozilla
- thunderbird
CWE