{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-1936"
      ],
      "details": "The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird\u0027s local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird \u003c 115.8.1.",
      "id": "GSD-2024-1936",
      "modified": "2024-02-28T06:02:28.875677Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@mozilla.org",
        "ID": "CVE-2024-1936",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Thunderbird",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "unspecified",
                          "version_value": "115.8.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Mozilla"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Several community reporters"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird\u0027s local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird \u003c 115.8.1."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Leaking of encrypted email subjects to other conversations"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1860977",
            "refsource": "MISC",
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1860977"
          },
          {
            "name": "https://www.mozilla.org/security/advisories/mfsa2024-11/",
            "refsource": "MISC",
            "url": "https://www.mozilla.org/security/advisories/mfsa2024-11/"
          },
          {
            "name": "https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html",
            "refsource": "MISC",
            "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird\u0027s local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird \u003c 115.8.1."
          },
          {
            "lang": "es",
            "value": "El asunto cifrado de un mensaje de correo electr\u00f3nico podr\u00eda asignarse de forma incorrecta y permanente a otro mensaje de correo electr\u00f3nico arbitrario en la cach\u00e9 local de Thunderbird. En consecuencia, al responder al mensaje de correo electr\u00f3nico contaminado, el usuario podr\u00eda filtrar accidentalmente el asunto confidencial a un tercero. Si bien esta actualizaci\u00f3n corrige el error y evita la contaminaci\u00f3n futura de mensajes, no repara autom\u00e1ticamente las contaminaciones existentes. Se recomienda a los usuarios que utilicen la funci\u00f3n de reparaci\u00f3n de carpetas, que est\u00e1 disponible en el men\u00fa contextual de las carpetas de correo electr\u00f3nico, que borrar\u00e1 las asignaciones de asuntos incorrectas. Esta vulnerabilidad afecta a Thunderbird \u0026lt; 115.8.1."
          }
        ],
        "id": "CVE-2024-1936",
        "lastModified": "2024-03-23T12:15:08.453",
        "metrics": {},
        "published": "2024-03-04T22:15:46.733",
        "references": [
          {
            "source": "security@mozilla.org",
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1860977"
          },
          {
            "source": "security@mozilla.org",
            "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html"
          },
          {
            "source": "security@mozilla.org",
            "url": "https://www.mozilla.org/security/advisories/mfsa2024-11/"
          }
        ],
        "sourceIdentifier": "security@mozilla.org",
        "vulnStatus": "Awaiting Analysis"
      }
    }
  }
}