Wsmwk

The issue arises when a MIME encoded email contains an OpenPGP inline signed or encrypted message part, along with an additional unprotected part. In such cases, Thunderbird fails to indicate that only parts of the message are protected. This is due to insufficient security measures implemented in the email client. An attacker could exploit this by sending a specially crafted email, potentially affecting data integrity.

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 78.8.1 Description: The issue is related to errors in handling OpenPGP cryptographic signatures in the Thunderbird email client. Exploitation of this issue could allow a remote attacker to impact the confidentiality and integrity of protected information. Specifically, Thunderbird fails to protect a secret OpenPGP key before using it for decryption, signing, or key import tasks. If such a task fails, the secret key may remain in memory in its unprotected state. Recommendations: For versions prior to 78.8.1, update to version 78.8.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of OpenPGP keys in Thunderbird until the update is applied.

The issue is related to the incorrect verification of OpenPGP cryptographic signatures in Thunderbird. If a user has previously imported someone's OpenPGP key and the key owner has extended the validity period of their key, but the updated key has not been imported, an attacker can send an email with a crafted version of the key containing an invalid subkey. This could cause Thunderbird to attempt to use the invalid subkey, resulting in a failure to send encrypted emails to the key owner.