UBUNTU-CVE-2021-38502

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2021-38502
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-38502.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2021-38502
Upstream
Downstream
Related
Published
2021-11-03T01:15:00Z
Modified
2025-09-08T16:47:18Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication method was configured, the MITM could obtain the authentication credentials, too. This vulnerability affects Thunderbird < 91.2.

References

Affected packages

Ubuntu:18.04:LTS / thunderbird

Package

Name
thunderbird
Purl
pkg:deb/ubuntu/thunderbird@1:91.5.0+build1-0ubuntu0.18.04.1?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:91.5.0+build1-0ubuntu0.18.04.1

Affected versions

1:52.*

1:52.4.0+build1-0ubuntu2
1:52.6.0+build1-0ubuntu1
1:52.7.0+build1-0ubuntu1
1:52.8.0+build1-0ubuntu0.18.04.1
1:52.9.1+build3-0ubuntu0.18.04.1

1:60.*

1:60.2.1+build1-0ubuntu0.18.04.2
1:60.4.0+build2-0ubuntu0.18.04.1
1:60.5.1+build2-0ubuntu0.18.04.1
1:60.6.1+build2-0ubuntu0.18.04.1
1:60.7.0+build1-0ubuntu0.18.04.1
1:60.7.1+build1-0ubuntu0.18.04.1
1:60.7.2+build2-0ubuntu0.18.04.1
1:60.8.0+build1-0ubuntu0.18.04.1
1:60.9.0+build1-0ubuntu0.18.04.1

1:68.*

1:68.2.1+build1-0ubuntu0.18.04.1
1:68.2.2+build1-0ubuntu0.18.04.1
1:68.4.1+build1-0ubuntu0.18.04.1
1:68.7.0+build1-0ubuntu0.18.04.1
1:68.8.0+build2-0ubuntu0.18.04.2
1:68.10.0+build1-0ubuntu0.18.04.1

1:78.*

1:78.8.1+build1-0ubuntu0.18.04.1
1:78.11.0+build1-0ubuntu0.18.04.2
1:78.13.0+build1-0ubuntu0.18.04.1
1:78.14.0+build1-0ubuntu0.18.04.1
1:78.14.0+build1-0ubuntu0.18.04.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.18.04.1",
            "binary_name": "thunderbird"
        },
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.18.04.1",
            "binary_name": "thunderbird-dev"
        },
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.18.04.1",
            "binary_name": "thunderbird-gnome-support"
        },
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.18.04.1",
            "binary_name": "thunderbird-mozsymbols"
        },
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.18.04.1",
            "binary_name": "xul-ext-calendar-timezones"
        },
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.18.04.1",
            "binary_name": "xul-ext-gdata-provider"
        },
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.18.04.1",
            "binary_name": "xul-ext-lightning"
        }
    ]
}

Ubuntu:20.04:LTS / thunderbird

Package

Name
thunderbird
Purl
pkg:deb/ubuntu/thunderbird@1:91.5.0+build1-0ubuntu0.20.04.1?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:91.5.0+build1-0ubuntu0.20.04.1

Affected versions

1:68.*

1:68.1.2+build1-0ubuntu1
1:68.1.2+build1-0ubuntu2
1:68.2.1+build1-0ubuntu1
1:68.2.2+build1-0ubuntu1
1:68.3.0+build2-0ubuntu1
1:68.3.1+build1-0ubuntu2
1:68.4.1+build1-0ubuntu1
1:68.4.2+build2-0ubuntu1
1:68.5.0+build1-0ubuntu1
1:68.6.0+build2-0ubuntu1
1:68.7.0+build1-0ubuntu1
1:68.7.0+build1-0ubuntu2
1:68.8.0+build2-0ubuntu0.20.04.2
1:68.10.0+build1-0ubuntu0.20.04.1

1:78.*

1:78.7.1+build1-0ubuntu0.20.04.1
1:78.8.1+build1-0ubuntu0.20.04.1
1:78.11.0+build1-0ubuntu0.20.04.2
1:78.13.0+build1-0ubuntu0.20.04.2
1:78.14.0+build1-0ubuntu0.20.04.1
1:78.14.0+build1-0ubuntu0.20.04.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.20.04.1",
            "binary_name": "thunderbird"
        },
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.20.04.1",
            "binary_name": "thunderbird-dev"
        },
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.20.04.1",
            "binary_name": "thunderbird-gnome-support"
        },
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.20.04.1",
            "binary_name": "thunderbird-mozsymbols"
        },
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.20.04.1",
            "binary_name": "xul-ext-calendar-timezones"
        },
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.20.04.1",
            "binary_name": "xul-ext-gdata-provider"
        },
        {
            "binary_version": "1:91.5.0+build1-0ubuntu0.20.04.1",
            "binary_name": "xul-ext-lightning"
        }
    ]
}

Ubuntu:22.04:LTS / thunderbird

Package

Name
thunderbird
Purl
pkg:deb/ubuntu/thunderbird@1:91.3.1+build1-0ubuntu1?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:91.3.1+build1-0ubuntu1

Affected versions

1:91.*

1:91.1.2+build1-0ubuntu1
1:91.3.0+build2-0ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1:91.3.1+build1-0ubuntu1",
            "binary_name": "thunderbird"
        },
        {
            "binary_version": "1:91.3.1+build1-0ubuntu1",
            "binary_name": "thunderbird-dev"
        },
        {
            "binary_version": "1:91.3.1+build1-0ubuntu1",
            "binary_name": "thunderbird-gnome-support"
        },
        {
            "binary_version": "1:91.3.1+build1-0ubuntu1",
            "binary_name": "thunderbird-mozsymbols"
        },
        {
            "binary_version": "1:91.3.1+build1-0ubuntu1",
            "binary_name": "xul-ext-calendar-timezones"
        },
        {
            "binary_version": "1:91.3.1+build1-0ubuntu1",
            "binary_name": "xul-ext-gdata-provider"
        },
        {
            "binary_version": "1:91.3.1+build1-0ubuntu1",
            "binary_name": "xul-ext-lightning"
        }
    ]
}