CVE-2021-23992

描述

Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects Thunderbird < 78.9.1.

如何修補 CVE-2021-23992

要修補 CVE-2021-23992,請將受影響套件升級到下列已修補版本。

• —升級至 1:78.10.0-1 或更新版本

CVE-2021-23992 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1:78.10.0-1

CVSS 分數

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-23992