CVE-2021-4126

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 91.4.1

Description The issue is related to how Thunderbird handles OpenPGP/MIME signed email messages with additional outer MIME message layers. Previously, Thunderbird only considered the inner signed message for signature validity, giving the false impression that the additional contents were also covered by the digital signature. This could allow a remote attacker to perform a spoofing attack due to insufficient warning about dangerous actions.

Recommendations For Thunderbird versions prior to 91.4.1, update to version 91.4.1 or later to ensure that only the signature belonging to the top-level MIME part is considered for the displayed status, thus preventing the false impression of additional contents being covered by the digital signature.