CVE-2022-2226

CVE Details

Release Date:

2022-12-22

Description

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11.

See more information about CVE-2022-2226 from MITRE CVE dictionary and NIST NVD

CVSS v3.0 metrics

NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.

Base Score:	6.5	Base Metrics:	AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Access Vector:	Network	Attack Complexity:	Low
Privileges Required:	None	User Interaction:	Required
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	High	Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (thunderbird)	ELSA-2022-5480	2022-07-01
Oracle Linux version 8 (thunderbird)	ELSA-2022-5470	2022-07-01
Oracle Linux version 9 (thunderbird)	ELSA-2022-5482	2022-07-02

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team