Use of a Broken or Risky Cryptographic Algorithm Affecting thunderbird package, versions <1:78.11.0+build1-0ubuntu2


Severity

Recommended
0.0
medium
0
10

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.08% (35th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Use of a Broken or Risky Cryptographic Algorithm vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-UBUNTU2110-THUNDERBIRD-1737568
  • published6 May 2021
  • disclosed24 Jun 2021

Introduced: 6 May 2021

CVE-2021-23993  (opens in a new tab)
CWE-327  (opens in a new tab)

How to fix?

Upgrade Ubuntu:21.10 thunderbird to version 1:78.11.0+build1-0ubuntu2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream thunderbird package and not the thunderbird package as distributed by Ubuntu. See How to fix? for Ubuntu:21.10 relevant fixed versions and status.

An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail. This vulnerability affects Thunderbird < 78.9.1.

CVSS Scores

version 3.1