Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2022-1197: When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept ...
CVE-2022-1197 · published 3 years ago
Summary
When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a rev...
What to do
- Update mozilla thunderbird to version 91.8 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mozilla | thunderbird |
< 91.8 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
Original advisory text
When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept ...
When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1754985 Issue Tracking Permissions Required Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-15/ Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-295Improper Certificate Validation
Timeline
Published22 Dec 2022
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-1197 · NVD
Track software like this
Free during beta