CVE-2021-38502: debian debian_linux
Vulnerability summary
CVE-2021-38502 is a medium (CVSS 5.9) vulnerability in debian debian_linux. EPSS estimates a 1.10% chance of exploitation in the next 30 days, higher than 65.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 11 · Related 4Timeline
- 03-11-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was configured, the MITM could obtain the authentication credentials, too. This vulnerability affects Thunderbird < 91.2.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.10%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.10% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Debian2 products
- thunderbird< 1:91.2.1-1
- debian_linuxEOL9.0 | 10.0 | 11.0
Mozilla1 product
- thunderbird≥ unspecified, < 91.2 | < 91.2
Ubuntu1 product
- thunderbird< 1:91.5.0+build1-0ubuntu0.18.04.1 | < 1:91.5.0+build1-0ubuntu0.20.04.1 | < 1:91.3.1+build1-0ubuntu1
3 vendors · 4 products
References
9 links- bugzilla.mozilla.org/show_bug.cgi?id=1733366X Refsource MISCIssue TrackingPermissions RequiredVendor Advisory
www.debian.org/security/2022/dsa-5034Vendor AdvisoryX Refsource DEBIANIssue TrackingThird Party Advisory- lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing ListX Refsource MLISTThird Party Advisory