Bug 2013469 (CVE-2021-38502)

Summary: CVE-2021-38502 Mozilla: Downgrade attack on SMTP STARTTLS connections
Product: [Other] Security Response Reporter: Doran Moppert <dmoppert>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: erack, jhorak, nobody, stransky, tpopela
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: thunderbird 91.2 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-13 14:08:25 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2010723, 2010724, 2010725, 2010727, 2010728, 2010729, 2010730, 2010731    
Bug Blocks: 2010721    

Description Doran Moppert 2021-10-12 23:19:33 UTC 
Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was configured, the MITM could obtain the authentication credentials, too.



External Reference:

https://www.mozilla.org/en-US/security/advisories/mfsa2021-47/#CVE-2021-38502
Comment 1 errata-xmlrpc 2021-10-13 09:25:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:3840 https://access.redhat.com/errata/RHSA-2021:3840
Comment 2 errata-xmlrpc 2021-10-13 09:26:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3839 https://access.redhat.com/errata/RHSA-2021:3839
Comment 3 errata-xmlrpc 2021-10-13 09:31:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3838 https://access.redhat.com/errata/RHSA-2021:3838
Comment 4 errata-xmlrpc 2021-10-13 09:57:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:3841 https://access.redhat.com/errata/RHSA-2021:3841
Comment 5 Product Security DevOps Team 2021-10-13 14:08:25 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-38502