PublicDateAtUSN: 2021-04-22 14:54:00 UTC
Candidate: CVE-2021-29950
PublicDate: 2021-06-24 14:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29950
 https://www.mozilla.org/en-US/security/advisories/mfsa2021-17/#CVE-2021-29950
 https://access.redhat.com/security/cve/CVE-2021-29950
 https://ubuntu.com/security/notices/USN-4936-1
Description:
 Thunderbird unprotects a secret OpenPGP key prior to using it for a
 decryption, signing or key import task. If the task runs into a failure,
 the secret key may remain in memory in its unprotected state. This
 vulnerability affects Thunderbird < 78.8.1.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N [7.5 HIGH]


Patches_thunderbird:
upstream_thunderbird: released (78.8.1)
precise/esm_thunderbird: DNE
trusty_thunderbird: ignored (out of standard support)
trusty/esm_thunderbird: DNE
xenial_thunderbird: ignored (end of standard support, was needs-triage)
esm-infra/xenial_thunderbird: needs-triage
bionic_thunderbird: released (1:78.8.1+build1-0ubuntu0.18.04.1)
focal_thunderbird: released (1:78.8.1+build1-0ubuntu0.20.04.1)
groovy_thunderbird: released (1:78.8.1+build1-0ubuntu0.20.10.1)
hirsute_thunderbird: not-affected (1:78.8.1+build1-0ubuntu1)
impish_thunderbird: not-affected (1:78.8.1+build1-0ubuntu1)
jammy_thunderbird: not-affected (1:78.8.1+build1-0ubuntu1)
devel_thunderbird: not-affected (1:78.8.1+build1-0ubuntu1)