CVE-2022-1197

What it actually does

Thunderbird fails to apply revocation status to an existing copy of an OpenPGP key when a new revocation certificate citing key compromise is imported, leaving the key marked as valid.

Why it matters to the business

Users and organizations relying on Thunderbird for encrypted or signed email may continue to trust and use cryptographic keys that have been reported as compromised, increasing the risk of message interception or forgery.

How an attack unfolds

An attacker obtains or fabricates a revocation certificate for a target OpenPGP key that specifies key compromise as the reason, then causes the victim Thunderbird client to import that certificate; because the client does not update the pre-existing key record, the compromised key remains usable for encryption and signature operations.

How to fix it

Upgrade Mozilla Thunderbird to version 91.8 or later on all affected systems; after upgrade, re-import any revocation certificates that specify key compromise to ensure existing keys are correctly marked revoked.

How to confirm the fix worked

Confirm installed Thunderbird version is 91.8 or higher; import a test revocation certificate that uses the key-compromise reason and verify the corresponding key is updated to revoked status in the key manager.

Typical attack path

1. Acquire or generate a revocation certificate for a target OpenPGP key specifying key-compromise reason
2. Deliver the revocation certificate to the target user via email, attachment, or keyserver
3. Induce Thunderbird to import the revocation certificate
4. Continue using the still-valid key copy for malicious encryption or signing operations

How to detect it

Examine Thunderbird keyring exports, import logs, and OpenPGP key lists for entries whose revocation status changed after the 91.8 release; correlate with email headers or keyserver queries that introduced new revocation packets citing key compromise.

What your security team should do

• Prioritize upgrade of all Thunderbird deployments to 91.8 or newer within standard patch windows
• Audit existing OpenPGP keyrings for keys that may have been imported with compromise revocations prior to the fix
• Establish routine key-revocation import testing as part of cryptographic hygiene procedures