Bug 2102204 (CVE-2022-2226)

Summary:	CVE-2022-2226 Mozilla: An email with a mismatching OpenPGP signature date was accepted as valid
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	erack, jhorak, nobody, stransky, tpopela
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	thunderbird 91.11, thunderbird 102	Doc Type:	---
Doc Text:	A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this issue of when an OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, it will show the email's date. If the dates were different, Thunderbird didn't report the email as having an invalid signature. If an attacker performs a replay attack, in which an old email with old contents is present at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-07-01 19:27:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2098644, 2098645, 2098646, 2098647, 2098648, 2098649, 2098650, 2098651, 2098652, 2098653
Bug Blocks:	2098636

Description Mauro Matteo Cascella 2022-06-29 13:07:22 UTC

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email.

External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2022-26/#CVE-2022-2226

Comment 1 errata-xmlrpc 2022-06-30 22:00:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:5478 https://access.redhat.com/errata/RHSA-2022:5478

Comment 2 errata-xmlrpc 2022-06-30 23:18:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:5473 https://access.redhat.com/errata/RHSA-2022:5473

Comment 3 errata-xmlrpc 2022-06-30 23:22:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:5470 https://access.redhat.com/errata/RHSA-2022:5470

Comment 4 errata-xmlrpc 2022-07-01 00:25:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:5475 https://access.redhat.com/errata/RHSA-2022:5475

Comment 5 errata-xmlrpc 2022-07-01 01:27:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:5480 https://access.redhat.com/errata/RHSA-2022:5480

Comment 6 errata-xmlrpc 2022-07-01 01:58:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:5482 https://access.redhat.com/errata/RHSA-2022:5482

Comment 7 Product Security DevOps Team 2022-07-01 19:27:03 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-2226