OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the users local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird < 78.10.2.
Weakness
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Thunderbird | Mozilla | 78.8.1 (including) | 78.10.1 (including) |
| Red Hat Enterprise Linux 7 | RedHat | thunderbird-0:78.11.0-1.el7_9 | * |
| Red Hat Enterprise Linux 8 | RedHat | thunderbird-0:78.11.0-1.el8_4 | * |
| Red Hat Enterprise Linux 8.1 Extended Update Support | RedHat | thunderbird-0:78.11.0-1.el8_1 | * |
| Red Hat Enterprise Linux 8.2 Extended Update Support | RedHat | thunderbird-0:78.11.0-1.el8_2 | * |
| Thunderbird | Ubuntu | bionic | * |
| Thunderbird | Ubuntu | devel | * |
| Thunderbird | Ubuntu | focal | * |
| Thunderbird | Ubuntu | groovy | * |
| Thunderbird | Ubuntu | hirsute | * |
| Thunderbird | Ubuntu | impish | * |
| Thunderbird | Ubuntu | jammy | * |
| Thunderbird | Ubuntu | kinetic | * |
| Thunderbird | Ubuntu | lunar | * |
| Thunderbird | Ubuntu | trusty | * |
| Thunderbird | Ubuntu | upstream | * |
| Thunderbird | Ubuntu | xenial | * |