CVE-2020-6794 log

Source
Severity Medium
Remote No
Type Information disclosure
Description
It has been found that setting a master password post-Thunderbird 52 does not delete unencrypted previously stored passwords before Thunderbird 68.5. If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations.
Group Package Affected Fixed Severity Status Ticket
AVG-1099 thunderbird 68.4.2-1 68.5.0-1 Critical Fixed
Date Advisory Group Package Severity Description
13 Feb 2020 ASA-202002-9 AVG-1099 thunderbird Critical multiple issues
References
https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6794
https://bugzilla.mozilla.org/show_bug.cgi?id=1606619