CVE-2022-2226

What it actually does

The vulnerability allows replay of old OpenPGP-signed emails because Thunderbird displays the email date rather than validating that the signature creation timestamp roughly matches it, bypassing the intended signature freshness check and permitting an attacker to present stale signed content as current.

Why it matters to the business

Users may be tricked into acting on outdated statements or instructions in resent emails, increasing risk of social-engineering success or erroneous business decisions based on stale but apparently legitimate signed messages; low exploit maturity and absence from KEV reduce immediate operational urgency.

How an attack unfolds

An attacker obtains a previously signed legitimate email, resends it at a later date without modification, and the recipient Thunderbird client shows the email date while accepting the old signature as valid, leading the victim to believe the content is recent.

How to fix it

Upgrade Thunderbird to version 102 or later, or to 91.11 or later; after upgrade the client will enforce that the signature creation date roughly matches the displayed email date.

How to confirm the fix worked

Confirm the installed Thunderbird version is 102 or 91.11 or newer; test by replaying a signed message with a mismatched date and verify that the client now flags the signature as invalid.

Typical attack path

1. Obtain a legitimately signed older email with OpenPGP signature
2. Resend the identical email at a later time without altering content or signature
3. Victim opens the message in an affected Thunderbird version
4. Client displays the current email date and treats the old signature as valid
5. Victim acts on the stale information under the false belief it is current

How to detect it

Review email logs and message headers for repeated identical signed messages arriving at significantly different times; inspect Thunderbird version telemetry to identify still-vulnerable clients.

What your security team should do

• Prioritize upgrade of all Thunderbird installations to a fixed release
• Communicate the replay risk to users who rely on OpenPGP-signed email
• Monitor vendor advisories for any subsequent signature-handling changes