{"id":"CLEANSTART-2024-RQ35637","summary":"If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignor...","details":"Security vulnerability affects the thunderbird package. If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data.","modified":"2026-10-31T16:02:27.321680950Z","published":"2026-10-31T14:16:16.581202Z","upstream":["CVE-2021-29969"],"database_specific":{},"references":[{"type":"ADVISORY","url":"https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2024/CLEANSTART-2024-RQ35637.json"},{"type":"WEB","url":"https://osv.dev/vulnerability/CVE-2021-29969"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29969"}],"affected":[{"package":{"name":"thunderbird","ecosystem":"CleanStart","purl":"pkg:apk/cleanstart/thunderbird"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"91.3.2-r0"}]}],"database_specific":{"source":"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2024/CLEANSTART-2024-RQ35637.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}