Bug 1186464

<https://www.theregister.com/2021/05/24/mozilla_thunderbird_openpgp_plaintext_keys/>

«The vulnerability, assessed as “low” impact by Mozilla, existed in the free open source Thunderbird email client between version 78.8.1 and version 78.10.1 after a crestfallen maintainer realised carefully designed protections were in fact not protecting users’ private OpenPGP keys.

Tracked as CVE-2021-29956, the vuln saw imported OpenPGP keys saved to users’ devices without encryption. A local attacker could therefore have viewed and copied the keys, allowing them to pose as the genuine sender of supposedly secure emails.»

«A few weeks ago some Thunderbird users on the desktop email client’s end-to-end encryption mailing list realised that on opening the program, they were able to view OpenPGP-encrypted emails without entering their master passwords. In Thunderbird, such messages are only supposed to be viewable after authenticating yourself.

“As soon as the user has configured a master password, the first time any of the stored secrets is required by Firefox/Thunderbird, the user will be prompted to enter it,” explained Engert. “If entered correctly, the symmetric key will be unlocked and remembered for the remainder of the session, and any protected secrets can be unlocked as needed.”»

(I commented myself on the later.)


We have Thunderbird version 78.10.0, thus vulnerable.