CVE-2020-12398

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 68.9.0

Description The issue arises when Thunderbird is configured to use STARTTLS for an IMAP server and the server sends a PREAUTH response. In this scenario, Thunderbird continues with an unencrypted connection, resulting in email data being sent without protection.

Recommendations For versions prior to 68.9.0, update to version 68.9.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of STARTTLS for IMAP servers until a patch is applied. Restrict access to sensitive email data to minimize the risk of exploitation. Avoid using unencrypted connections for email data transfer until the issue is resolved.