---

CVE-2021-23992 - log back

CVE-2021-23992 edited at 13 Apr 2021 19:00:44
Severity	- Unknown + Medium
Remote	- Unknown + Remote
Type	- Unknown + Signature forgery
Description	+ Thunderbird before version 78.9.1 did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent.
References	+ https://www.mozilla.org/en-US/security/advisories/mfsa2021-13/#CVE-2021-23992 + https://bugzilla.mozilla.org/show_bug.cgi?id=1666236

CVE-2021-23992 created at 13 Apr 2021 18:59:09
Severity	+ Unknown
Remote	+ Unknown
Type	+ Unknown
Description
References
Notes