CVE-2022-1197
Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 22 Dec 2022, 00:00
Last modified:16 Apr 2025, 15:25
Vulnerability Summary
Overall Risk (default)
low
22/100 CVSS Score
5.4 MEDIUM
v3.1 (cve.org)
EPSS Score
0.24% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
22 Dec 2022, 00:00
Published
Vulnerability first disclosed
16 Apr 2025, 15:25
Last Modified
Vulnerability information updated
Description
When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8.
CVSS Metrics
- v3.1•MEDIUM•Score: 5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS Trends
Current EPSS score: 0.24%• Percentile: 47%
Techniques & Countermeasures
- CWE-295•Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Affected Systems
- mozilla•thunderbird
≥ unspecified, < 91.8 | < 91.8