Vulnerability · Published Nov 3, 2021 · Assigned by mozilla
CVE-2021-38502
Medium 5.9
In plain English
A medium-severity security flaw in Thunderbird from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was configured, the MITM could obtain the authentication credentials, too. This vulnerability affects Thunderbird < 91.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | thunderbird | 91.3.2-r0 | ALPINE-CVE-2021-38502 |
| Alpine:v3.21 | thunderbird | 91.3.2-r0 | ALPINE-CVE-2021-38502 |
| Alpine:v3.22 | thunderbird | 91.3.2-r0 | ALPINE-CVE-2021-38502 |
| Alpine:v3.23 | thunderbird | 91.3.2-r0 | ALPINE-CVE-2021-38502 |
| Debian:12 | thunderbird | 1:91.2.1-1 | DEBIAN-CVE-2021-38502 |
| Debian:13 | thunderbird | 1:91.2.1-1 | DEBIAN-CVE-2021-38502 |
| Debian:14 | thunderbird | 1:91.2.1-1 | DEBIAN-CVE-2021-38502 |
| Rocky Linux:8 | thunderbird | 0:91.2.0-1.el8_4 | RLSA-2021:3838 |
| Ubuntu:22.04:LTS | thunderbird | 1:91.3.1+build1-0ubuntu1 | UBUNTU-CVE-2021-38502 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Thunderbird | unspecified – before 91.2 |
References
- https://www.mozilla.org/security/advisories/mfsa2021-47/ x_refsource_MISC
- https://bugzilla.mozilla.org/show_bug.cgi?id=1733366 x_refsource_MISC
- DSA-5034 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20220104 [SECURITY] [DLA 2874-1] thunderbird security update mailing-list, x_refsource_MLIST