Bug 2072963 (CVE-2022-1197)

Summary:	CVE-2022-1197 Mozilla: OpenPGP revocation information was ignored
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	erack, jhorak, nobody, stransky, tpopela
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	thunderbird 91.8	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-04-12 18:27:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2072587, 2072588, 2072589, 2072590, 2072591, 2072592, 2072593, 2072594, 2072595, 2072600
Bug Blocks:	2072585

Description Mauro Matteo Cascella 2022-04-07 11:01:55 UTC

When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected.



External Reference:

https://www.mozilla.org/en-US/security/advisories/mfsa2022-15/#CVE-2022-1197

Comment 1 errata-xmlrpc 2022-04-11 13:50:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:1303 https://access.redhat.com/errata/RHSA-2022:1303

Comment 2 errata-xmlrpc 2022-04-11 14:14:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1301 https://access.redhat.com/errata/RHSA-2022:1301

Comment 3 errata-xmlrpc 2022-04-11 14:32:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:1305 https://access.redhat.com/errata/RHSA-2022:1305

Comment 4 errata-xmlrpc 2022-04-11 14:49:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:1302 https://access.redhat.com/errata/RHSA-2022:1302

Comment 5 errata-xmlrpc 2022-04-12 14:32:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:1326 https://access.redhat.com/errata/RHSA-2022:1326

Comment 6 Product Security DevOps Team 2022-04-12 18:27:38 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-1197