CVE-2022-1197

EPSS 0.08%
Published 22.12.2022 20:15:13
Last modified 16.04.2025 16:15:20
Source security@mozilla.org
Teams watchlist Login
Open Login

When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Mozilla ≫ Thunderbird Version < 91.8

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.08%	0.246

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.4	2.8	2.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.4	2.8	2.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://www.mozilla.org/security/advisories/mfsa2022-15/

Vendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=1754985

Vendor Advisory

Issue Tracking

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2022-1197

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-1197

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-1197

EUVD