What is CVE-2022-1197?

CVE-2022-1197 is a medium-severity vulnerability in Mozilla Thunderbird, classified under Improper Certificate Validation. CVSS score: 5.4/10. Published 2022-12-22.

How severe is CVE-2022-1197?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Vulnerability in Mozilla Thunderbird

CVE-2022-1197

When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8.

Vulnerability class: Improper Certificate Validation

EPSS: 0.004 (29.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N.

Affected products

Mozilla Thunderbird — versions unspecified

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

References

security@mozilla.org (Vendor Advisory)
security@mozilla.org (Permissions Required, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2022-1197?: CVE-2022-1197 is a medium-severity vulnerability in Mozilla Thunderbird, classified under Improper Certificate Validation. CVSS score: 5.4/10. Published 2022-12-22.
How severe is CVE-2022-1197?: Medium severity. CVSS v3 base score is 5.4 out of 10.