CVE-2021-23991

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 78.9.1

Description The issue is related to the incorrect verification of OpenPGP cryptographic signatures in Thunderbird. If a user has previously imported someone's OpenPGP key and the key owner has extended the validity period of their key, but the updated key has not been imported, an attacker can send an email with a crafted version of the key containing an invalid subkey. This could cause Thunderbird to attempt to use the invalid subkey, resulting in a failure to send encrypted emails to the key owner.

Recommendations For Thunderbird versions prior to 78.9.1, update to version 78.9.1 or later to resolve the issue.