DEBIAN-CVE-2022-1197

Advisory lineage Upstream: 1 Downstream: 2
Upstream
CVE-2022-1197
Published: 22 Dec 2022, 20:15
Last modified:28 Apr 2026, 20:23

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.4 MEDIUM
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

22 Dec 2022, 20:15
Published
Vulnerability first disclosed
28 Apr 2026, 20:23
Last Modified
Vulnerability information updated

Description

When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected Systems

  • debian•thunderbird

    < 1:91.8.0-1~deb11u1 | < 1:91.8.0-1 | < 1:91.8.0-1 | < 1:91.8.0-1

References (1)