Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2020-6794: Thunderbird may keep old passwords unprotected after adding master password
CVE-2020-6794 · published 6 years ago
Summary
If you saved passwords in Thunderbird before version 60 and later set a master password, the program still stores a copy of those old passwords in a file that isn’t encrypted. That file can be read by anyone who accesses your computer, bypassing the master password protection. Upgrade Thunderbird to version 68.5 or newer and re‑enter your saved passwords, or remove the old password file, to eliminate the risk.
What to do
- Update debian thunderbird to version 1:68.5.0-1.
- Update mozilla thunderbird to version 68.5.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | thunderbird |
< 1:68.5.0-1 Fix: upgrade to 1:68.5.0-1
|
| Debian:13 | debian | thunderbird |
< 1:68.5.0-1 Fix: upgrade to 1:68.5.0-1
|
| Debian:14 | debian | thunderbird |
< 1:68.5.0-1 Fix: upgrade to 1:68.5.0-1
|
| – | mozilla | thunderbird |
< 68.5.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
16.04 18.04 19.10 cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* |
Original advisory text
If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was ...
If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird < 68.5.
References
- https://security-tracker.debian.org/tracker/CVE-2020-6794 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1606619 Exploit Issue Tracking Patch Vendor Advisory
- https://security.gentoo.org/glsa/202003-10 Third Party Advisory
- https://usn.ubuntu.com/4328-1/ Third Party Advisory
- https://usn.ubuntu.com/4335-1/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-07/ Vendor Advisory
Severity
6.5
Medium
Type
CWE-312Cleartext Storage of Sensitive Information
CWE-459Incomplete Cleanup
CWE-522Insufficiently Protected Credentials
Timeline
Published2 Mar 2020
Updated31 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta