CVE-2023-0547

What it actually does

The application fails to perform OCSP revocation checks on recipient certificates during S/MIME email encryption, allowing certificates that have been revoked to be treated as valid for encryption operations.

Why it matters to the business

Organizations using older versions of the email client risk sending encrypted messages to recipients whose keys are known to be compromised, potentially exposing sensitive communications to unauthorized parties without detection.

How an attack unfolds

An attacker obtains or controls a revoked certificate for a target recipient, then relies on the client's omission of OCSP checks so that the revoked certificate is accepted for S/MIME encryption; the attacker can later decrypt messages encrypted to that certificate.

How to fix it

Upgrade Mozilla Thunderbird to version 102.10 or later on all systems; enable automatic updates where possible and verify the installed version after patching.

How to confirm the fix worked

Confirm the Thunderbird version is at least 102.10; test by attempting to send S/MIME encrypted mail to a known-revoked test certificate and verify that the operation is now rejected.

Typical attack path

1. Identify a target recipient whose certificate has been revoked
2. Ensure the revoked certificate remains in use or discoverable
3. Send or cause the victim to send an S/MIME encrypted message to the recipient
4. Intercept or access the encrypted message using the compromised private key

How to detect it

Review email client logs and update histories for installations that remained on versions prior to 102.10; search mail server or client logs for S/MIME encryption events involving certificates that later appear on revocation lists.

What your security team should do

• Prioritize upgrade of all Thunderbird instances to 102.10+ within the next maintenance window
• Audit S/MIME usage across the organization and disable it where revocation checking cannot be guaranteed
• Monitor vendor advisories for any follow-on cryptographic updates