Bug 1673240 Comment 22 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
Suggested CVE text:

```
CVE-??:
     title: An attacker may use Thunderbird's OpenPGP key refresh mechanism to
poison an existing key
     impact: moderate
     reporter: Cure53
     description: |
       If a Thunderbird user has previously imported Alice's OpenPGP key, and
Alice has extended the validity period of her key, but Alice's updated key has
not yet been imported, an attacker may send an email containing a crafted
version of Alice's key with an invalid subkey, Thunderbird might subsequently
attempt to use the invalid subkey, and will fail to send encrypted email to
Alice.
     bugs:
       - url: 1666236
```

Note we still allow the automatic import, but the invalid key details will no longer result in DoS.
Revision 1 by
on 
Suggested CVE text:

```
CVE-??:
     title: An attacker may use Thunderbird's OpenPGP key refresh mechanism to
poison an existing key
     impact: moderate
     reporter: Cure53
     description: |
       If a Thunderbird user has previously imported Alice's OpenPGP key, and
Alice has extended the validity period of her key, but Alice's updated key has
not yet been imported, an attacker may send an email containing a crafted
version of Alice's key with an invalid subkey, Thunderbird might subsequently
attempt to use the invalid subkey, and will fail to send encrypted email to
Alice.
     bugs:
       - url: 1673240
```

Note we still allow the automatic import, but the invalid key details will no longer result in DoS.

Edit: fixed the bug number

Back to Bug 1673240 Comment 22