CVE-2020-12398 — Cleartext Transmission of Sensitive Info in Mozilla Thunderbird

CWE-319 — Cleartext Transmission of Sensitive InfoCWE-200 — Sensitive Information ExposureCWE-311 — Missing Encryption of Sensitive Data10 documents9 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 50.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla ThunderbirdCanonical Ubuntu Linux
Timeline
PublishedJul 9
Latest updateMay 24

Description

If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. This vulnerability affects Thunderbird < 68.9.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5mozilla/thunderbirdunspecified — 68.9.0
▶NVDmozilla/thunderbird< 68.9.0
▶Debianmozilla/thunderbird< 1:68.9.0-1+3
▶Ubuntumozilla/thunderbird< 1:68.10.0+build1-0ubuntu0.16.04.1+2

Also affects: Ubuntu Linux 16.04, 18.04, 19.10, 20.04

🔴Vulnerability Details

4
GHSA
GHSA-jvxv-vphc-73rg: If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unenc↗2022-05-24
▶
CVEList
CVE-2020-12398: If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unenc↗2020-07-09
▶
OSV
CVE-2020-12398: If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unenc↗2020-07-09
▶
OSV
thunderbird vulnerabilities↗2020-07-08
▶

📋Vendor Advisories

4
Ubuntu
Thunderbird vulnerabilities↗2020-07-08
▶
Red Hat
Mozilla: Security downgrade with IMAP STARTTLS leads to information leakage↗2020-06-02
▶
Debian
CVE-2020-12398: thunderbird - If Thunderbird is configured to use STARTTLS for an IMAP server, and the server ...↗2020
▶
Mozilla
Mozilla Foundation Security Advisory 2020-22: CVE-2020-12398↗
▶

💬Community

1
Bugzilla
CVE-2020-12398 Mozilla: Security downgrade with IMAP STARTTLS leads to information leakage↗2020-06-11
▶
CVE-2020-12398 — Mozilla Thunderbird vulnerability | cvebase