CVE-2021-29969

Source
https://nvd.nist.gov/vuln/detail/CVE-2021-29969
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29969.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-29969
Downstream
Related
Published
2021-08-05T20:15:08Z
Modified
2025-08-09T19:01:27Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability affects Thunderbird < 78.12.

References

Affected packages