CVE-2021-23993: mozilla thunderbird
Vulnerability summary
CVE-2021-23993 is a medium (CVSS 6.5) vulnerability in mozilla thunderbird. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 11 · Related 4Timeline
- 24-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail. This vulnerability affects Thunderbird < 78.9.1.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
0.00 pp
From 0.43% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- thunderbird< 1:78.10.0-1
Mozilla1 product
- thunderbird≥ unspecified, < 78.9.1 | < 78.9.1
Ubuntu1 product
- thunderbird< 1:78.11.0+build1-0ubuntu0.18.04.2 | < 1:78.11.0+build1-0ubuntu0.20.04.2
3 vendors · 3 products
References
8 links- bugzilla.mozilla.org/show_bug.cgi?id=1666360X Refsource MISCIssue TrackingPermissions RequiredVendor Advisory
