CVE-2021-43529 - Vulnerability Details - OpenCVE

Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Mozilla	Thunderbird
Redhat	Enterprise Linux Rhel Eus

Configuration 1 [-]

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 7
thunderbird-0:91.3.0-2.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2021:4134	2021-11-04T00:00:00Z
Red Hat Enterprise Linux 8
thunderbird-0:91.3.0-2.el8_4	cpe:/a:redhat:enterprise_linux:8	RHSA-2021:4130	2021-11-04T00:00:00Z
Red Hat Enterprise Linux 8.1 Extended Update Support
thunderbird-0:91.3.0-2.el8_1	cpe:/a:redhat:rhel_eus:8.1	RHSA-2021:4133	2021-11-04T00:00:00Z
Red Hat Enterprise Linux 8.2 Extended Update Support
thunderbird-0:91.3.0-2.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2021:4132	2021-11-04T00:00:00Z

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2021-43527
https://access.redhat.com/security/vulnerabilities/RHSB-2021-008
https://bugzilla.mozilla.org/show_bug.cgi?id=1738501
https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529
https://nvd.nist.gov/vuln/detail/CVE-2021-43529
https://www.cve.org/CVERecord?id=CVE-2021-43529

History

Wed, 19 Mar 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2023-02-16T00:00:00.000Z

Updated: 2025-03-19T15:00:31.859Z

Reserved: 2021-11-08T00:00:00.000Z

Link: CVE-2021-43529

Vulnrichment

Updated: 2024-08-04T03:55:29.265Z

NVD

Status : Modified

Published: 2023-02-16T22:15:10.810

Modified: 2025-03-19T15:15:36.897

Link: CVE-2021-43529

Redhat

Severity : Critical

Publid Date: 2021-12-01T00:00:00Z

Links: CVE-2021-43529 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-43529", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "dateUpdated": "2025-03-19T15:00:31.859Z", "dateReserved": "2021-11-08T00:00:00.000Z", "datePublished": "2023-02-16T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2023-02-16T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures."}], "affected": [{"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"version": "unspecified", "lessThan": "91.3.0", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Memory corruption when processing S/MIME messages"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:55:29.265Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-03-19T15:00:26.576004Z", "id": "CVE-2021-43529", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-19T15:00:31.859Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:55:29.265Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2021-43529", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-19T15:00:26.576004Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-19T14:58:26.491Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "91.3.0", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Memory corruption when processing S/MIME messages"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2023-02-16T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2021-43529", "state": "PUBLISHED", "dateUpdated": "2025-03-19T15:00:31.859Z", "dateReserved": "2021-11-08T00:00:00.000Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2023-02-16T00:00:00.000Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "65E19CA9-5FDF-4253-8D56-FD82239F7D93", "versionEndExcluding": "91.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures."}, {"lang": "es", "value": "Las versiones de Thunderbird anteriores a la 91.3.0 son vulnerables al desbordamiento del almacenamiento din\u00e1mico descrito en CVE-2021-43527 al procesar mensajes S/MIME. Las versiones 91.3.0 y posteriores de Thunderbird no llamar\u00e1n al c\u00f3digo vulnerable al procesar mensajes S/MIME que contengan certificados con firmas DSA o RSA-PSS codificadas en DER."}], "id": "CVE-2021-43529", "lastModified": "2025-03-19T15:15:36.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-02-16T22:15:10.810", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2021:4134", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:91.3.0-2.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2021-11-04T00:00:00Z"}, {"advisory": "RHSA-2021:4130", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:91.3.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2021-11-04T00:00:00Z"}, {"advisory": "RHSA-2021:4133", "cpe": "cpe:/a:redhat:rhel_eus:8.1", "package": "thunderbird-0:91.3.0-2.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Extended Update Support", "release_date": "2021-11-04T00:00:00Z"}, {"advisory": "RHSA-2021:4132", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "thunderbird-0:91.3.0-2.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2021-11-04T00:00:00Z"}], "bugzilla": {"description": "thunderbird: Memory corruption when processing S/MIME messages", "id": "2088353", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2088353"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-120", "details": ["Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.", "A flaw was found in Thunderbird, which is vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures."], "name": "CVE-2021-43529", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2021-12-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-43529\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-43529\nhttps://access.redhat.com/security/cve/CVE-2021-43527\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2021-008\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1738501"], "statement": "Thunderbird is affected when parsing email with the S/MIME signature. Thunderbird on Red Hat Enterprise Linux 8.4 and later does not need to be updated since it uses the system NSS library, but earlier Red Hat Enterprise Linux 8 extended lifestreams will need to update Thunderbird as well as NSS.", "threat_severity": "Critical"}