gsd-2022-2226
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2022-2226",
"description": "An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email\u0027s date will be shown. If the dates were different, then Thunderbird didn\u0027t report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature\u0027s date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11.",
"id": "GSD-2022-2226"
},
"gsd": {
"affected": [
{
"package": {
"ecosystem": "Mozilla",
"name": "Thunderbird"
},
"ranges": [
{
"events": [
{
"fixed": "91.11"
},
{
"introduced": "0"
},
{
"fixed": "102"
},
{
"introduced": "0"
}
],
"type": "SEMVER"
}
],
"version": []
}
],
"alias": [
"CVE-2022-2226"
],
"database_specific": {
"GSD": {
"alias": "CVE-2022-2226",
"id": "GSD-2022-2226",
"references": [
"https://www.debian.org/security/2022/dsa-5175",
"https://advisories.mageia.org/CVE-2022-2226.html",
"https://access.redhat.com/errata/RHSA-2022:5470",
"https://access.redhat.com/errata/RHSA-2022:5473",
"https://access.redhat.com/errata/RHSA-2022:5475",
"https://access.redhat.com/errata/RHSA-2022:5478",
"https://access.redhat.com/errata/RHSA-2022:5480",
"https://access.redhat.com/errata/RHSA-2022:5482",
"https://www.suse.com/security/cve/CVE-2022-2226.html",
"https://ubuntu.com/security/CVE-2022-2226"
]
}
},
"details": "An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email\u0027s date will be shown. If the dates were different, then Thunderbird didn\u0027t report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature\u0027s date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 91.11 and Thunderbird \u003c 102.",
"id": "GSD-2022-2226",
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"modified": "2022-09-27T16:35:18.200169Z",
"osvSchema": {
"aliases": [
"CVE-2022-2226"
],
"details": "An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email\u0027s date will be shown. If the dates were different, then Thunderbird didn\u0027t report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature\u0027s date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11.",
"id": "GSD-2022-2226",
"modified": "2023-12-13T01:19:19.948644Z",
"schema_version": "1.4.0"
},
"references": [
{
"type": "ADVISORY",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-26/"
},
{
"type": "ADVISORY",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1775441"
},
{
"type": "ADVISORY",
"url": "https://www.debian.org/security/2022/dsa-5175"
},
{
"type": "ADVISORY",
"url": "https://advisories.mageia.org/CVE-2022-2226.html"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2022:5470"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2022:5473"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2022:5475"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2022:5478"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2022:5480"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2022:5482"
},
{
"type": "ADVISORY",
"url": "https://www.suse.com/security/cve/CVE-2022-2226.html"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/CVE-2022-2226"
}
],
"schema_version": "1.3.0",
"summary": "An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email\u0027s date will be shown. If the dates were different, then Thunderbird didn\u0027t report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature\u0027s date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 91.11 and Thunderbird \u003c 102."
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security@mozilla.org",
"ID": "CVE-2022-2226",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Thunderbird",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "102"
},
{
"version_affected": "\u003c",
"version_value": "91.11"
}
]
}
}
]
},
"vendor_name": "Mozilla"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email\u0027s date will be shown. If the dates were different, then Thunderbird didn\u0027t report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature\u0027s date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "An email with a mismatching OpenPGP signature date was accepted as valid"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.mozilla.org/security/advisories/mfsa2022-26/",
"refsource": "MISC",
"url": "https://www.mozilla.org/security/advisories/mfsa2022-26/"
},
{
"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1775441",
"refsource": "MISC",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1775441"
}
]
}
},
"mozilla.org": {
"CVE_data_meta": {
"ASSIGNER": "security@mozilla.org",
"ID": "CVE-2022-2226"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Thunderbird",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "91.11"
},
{
"version_affected": "\u003c",
"version_value": "102"
}
]
}
}
]
},
"vendor_name": "Mozilla"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email\u0027s date will be shown. If the dates were different, then Thunderbird didn\u0027t report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature\u0027s date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 91.11 and Thunderbird \u003c 102."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "An email with a mismatching OpenPGP signature date was accepted as valid"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://www.mozilla.org/security/advisories/mfsa2022-26/"
},
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1775441"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "91.11",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:101.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security@mozilla.org",
"ID": "CVE-2022-2226"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email\u0027s date will be shown. If the dates were different, then Thunderbird didn\u0027t report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature\u0027s date roughly matches the displayed date of the email. This vulnerability affects Thunderbird \u003c 102 and Thunderbird \u003c 91.11."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-294"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.mozilla.org/security/advisories/mfsa2022-26/",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mozilla.org/security/advisories/mfsa2022-26/"
},
{
"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1775441",
"refsource": "MISC",
"tags": [
"Issue Tracking",
"Permissions Required",
"Vendor Advisory"
],
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1775441"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
},
"lastModifiedDate": "2023-01-05T13:52Z",
"publishedDate": "2022-12-22T20:15Z"
}
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.