Red Hat: CVE-2023-50761: Mozilla: S/MIME signature accepted despite mismatching message date (Multiple Advisories)

Red Hat: CVE-2023-50761: Mozilla: S/MIME signature accepted despite mismatching message date (Multiple Advisories)

Severity

8

CVSS

(AV:N/AC:H/Au:N/C:C/I:C/A:C)

Published

12/19/2023

Created

01/04/2024

Added

01/03/2024

Modified

09/03/2024

Description

The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare the signature creation date with the message date and time, and displayed a valid signature despite a date or time mismatch. This could be used to give recipients the impression that a message was sent at a different date or time. This vulnerability affects Thunderbird < 115.6.

Solution(s)

• redhat-upgrade-thunderbird
• redhat-upgrade-thunderbird-debuginfo
• redhat-upgrade-thunderbird-debugsource

References

• CVE-2023-50761
• RHSA-2024:0001
• RHSA-2024:0002
• RHSA-2024:0003
• RHSA-2024:0004
• RHSA-2024:0005
• RHSA-2024:0027
• RHSA-2024:0029

View more