Bug 2102204 (CVE-2022-2226) - CVE-2022-2226 Mozilla: An email with a mismatching OpenPGP signature date was accepted as valid
Summary: CVE-2022-2226 Mozilla: An email with a mismatching OpenPGP signature date was...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-2226
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2098644 2098645 2098646 2098647 2098648 2098649 2098650 2098651 2098652 2098653
Blocks: 2098636
TreeView+ depends on / blocked
 
Reported: 2022-06-29 13:07 UTC by Mauro Matteo Cascella
Modified: 2022-07-01 19:27 UTC (History)
5 users (show)

Fixed In Version: thunderbird 91.11, thunderbird 102
Doc Type: ---
Doc Text:
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this issue of when an OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, it will show the email's date. If the dates were different, Thunderbird didn't report the email as having an invalid signature. If an attacker performs a replay attack, in which an old email with old contents is present at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email.
Clone Of:
Environment:
Last Closed: 2022-07-01 19:27:04 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:5470 0 None None None 2022-06-30 23:22:26 UTC
Red Hat Product Errata RHSA-2022:5473 0 None None None 2022-06-30 23:18:26 UTC
Red Hat Product Errata RHSA-2022:5475 0 None None None 2022-07-01 00:25:06 UTC
Red Hat Product Errata RHSA-2022:5478 0 None None None 2022-06-30 22:00:03 UTC
Red Hat Product Errata RHSA-2022:5480 0 None None None 2022-07-01 01:27:28 UTC
Red Hat Product Errata RHSA-2022:5482 0 None None None 2022-07-01 01:58:28 UTC

Description Mauro Matteo Cascella 2022-06-29 13:07:22 UTC 
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email.

External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2022-26/#CVE-2022-2226
Comment 1 errata-xmlrpc 2022-06-30 22:00:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:5478 https://access.redhat.com/errata/RHSA-2022:5478
Comment 2 errata-xmlrpc 2022-06-30 23:18:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:5473 https://access.redhat.com/errata/RHSA-2022:5473
Comment 3 errata-xmlrpc 2022-06-30 23:22:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:5470 https://access.redhat.com/errata/RHSA-2022:5470
Comment 4 errata-xmlrpc 2022-07-01 00:25:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:5475 https://access.redhat.com/errata/RHSA-2022:5475
Comment 5 errata-xmlrpc 2022-07-01 01:27:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:5480 https://access.redhat.com/errata/RHSA-2022:5480
Comment 6 errata-xmlrpc 2022-07-01 01:58:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:5482 https://access.redhat.com/errata/RHSA-2022:5482
Comment 7 Product Security DevOps Team 2022-07-01 19:27:03 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-2226
Note You need to log in before you can comment on or make changes to this bug.