CVE-2023-0430

What it actually does

The application skipped OCSP revocation checks during S/MIME signature validation, causing signatures produced with revoked certificates to be treated as valid.

Why it matters to the business

Users may act on forged or malicious email that appears to carry a legitimate signature, increasing successful phishing and social-engineering risk until the software is updated.

How an attack unfolds

An attacker obtains a revoked S/MIME certificate, signs a crafted message with it, and delivers the message to a victim running an affected Thunderbird version; the client displays the signature as valid because revocation status is never queried.

How to fix it

Upgrade Mozilla Thunderbird to version 102.7.1 or later; after upgrade, re-verify any previously received S/MIME-signed messages.

How to confirm the fix worked

Confirm the installed Thunderbird version is at least 102.7.1; optionally test by importing a known-revoked test certificate and confirming that signed messages are now rejected.

Typical attack path

1. Acquire or reuse a revoked email-signing certificate
2. Craft and sign a message using the revoked certificate
3. Deliver the signed message via email to the target mailbox
4. Victim client renders the message with a valid-signature indicator

How to detect it

Search mail-server and client logs for S/MIME signature validation events around the time of message receipt; correlate any anomalies with known-revoked certificate serial numbers if available from internal PKI logs.

What your security team should do

• Prioritize deployment of Thunderbird 102.7.1+ across all endpoints within the next patching cycle
• Review mail-gateway rules that may allow S/MIME-signed messages from untrusted sources
• Educate users to treat signature validity as one factor among several when evaluating message authenticity