p PatchFirst

CVE-2021-38502

CVE-2021-38502

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was configured, the MITM could obtain the authentication credentials, too. This vulnerability affects Thunderbird < 91.2.

CVSS 5.9 · Medium · EPSS 1.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • thunderbird

    Versions
    • ≥ unspecified, < 91.2: Affected (custom)

    Update to 91.2

  • thunderbird Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:91.2.1-1

    Update to 1:91.2.1-1

  • thunderbird Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:91.2.1-1

    Update to 1:91.2.1-1

  • thunderbird Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:91.2.1-1

    Update to 1:91.2.1-1

  • thunderbird Ubuntu:18.04:LTS

    Versions
    • 1:52.4.0+build1-0ubuntu2
    • 1:52.6.0+build1-0ubuntu1
    • 1:52.7.0+build1-0ubuntu1
    • 1:52.8.0+build1-0ubuntu0.18.04.1
    • 1:52.9.1+build3-0ubuntu0.18.04.1
    • 1:60.2.1+build1-0ubuntu0.18.04.2
    • 1:60.4.0+build2-0ubuntu0.18.04.1
    • 1:60.5.1+build2-0ubuntu0.18.04.1
    • 1:60.6.1+build2-0ubuntu0.18.04.1
    • 1:60.7.0+build1-0ubuntu0.18.04.1
    • 1:60.7.1+build1-0ubuntu0.18.04.1
    • 1:60.7.2+build2-0ubuntu0.18.04.1
    • 1:60.8.0+build1-0ubuntu0.18.04.1
    • 1:60.9.0+build1-0ubuntu0.18.04.1
    • 1:68.2.1+build1-0ubuntu0.18.04.1
    • 1:68.2.2+build1-0ubuntu0.18.04.1
    • 1:68.4.1+build1-0ubuntu0.18.04.1
    • 1:68.7.0+build1-0ubuntu0.18.04.1
    • 1:68.8.0+build2-0ubuntu0.18.04.2
    • 1:68.10.0+build1-0ubuntu0.18.04.1
    • 1:78.8.1+build1-0ubuntu0.18.04.1
    • 1:78.11.0+build1-0ubuntu0.18.04.2
    • 1:78.13.0+build1-0ubuntu0.18.04.1
    • 1:78.14.0+build1-0ubuntu0.18.04.1
    • 1:78.14.0+build1-0ubuntu0.18.04.2
    Affected ranges
    • ECOSYSTEM: < 1:91.5.0+build1-0ubuntu0.18.04.1

    Update to 1:91.5.0+build1-0ubuntu0.18.04.1

  • thunderbird Ubuntu:20.04:LTS

    Versions
    • 1:68.1.2+build1-0ubuntu1
    • 1:68.1.2+build1-0ubuntu2
    • 1:68.2.1+build1-0ubuntu1
    • 1:68.2.2+build1-0ubuntu1
    • 1:68.3.0+build2-0ubuntu1
    • 1:68.3.1+build1-0ubuntu2
    • 1:68.4.1+build1-0ubuntu1
    • 1:68.4.2+build2-0ubuntu1
    • 1:68.5.0+build1-0ubuntu1
    • 1:68.6.0+build2-0ubuntu1
    • 1:68.7.0+build1-0ubuntu1
    • 1:68.7.0+build1-0ubuntu2
    • 1:68.8.0+build2-0ubuntu0.20.04.2
    • 1:68.10.0+build1-0ubuntu0.20.04.1
    • 1:78.7.1+build1-0ubuntu0.20.04.1
    • 1:78.8.1+build1-0ubuntu0.20.04.1
    • 1:78.11.0+build1-0ubuntu0.20.04.2
    • 1:78.13.0+build1-0ubuntu0.20.04.2
    • 1:78.14.0+build1-0ubuntu0.20.04.1
    • 1:78.14.0+build1-0ubuntu0.20.04.2
    Affected ranges
    • ECOSYSTEM: < 1:91.5.0+build1-0ubuntu0.20.04.1

    Update to 1:91.5.0+build1-0ubuntu0.20.04.1

  • thunderbird Ubuntu:22.04:LTS

    Versions
    • 1:91.1.2+build1-0ubuntu1
    • 1:91.3.0+build2-0ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1:91.3.1+build1-0ubuntu1

    Update to 1:91.3.1+build1-0ubuntu1

Original sources

Check your server →