| Package | Affected versions | Patched versions |
|---|---|---|
| thunderbird | ≥ 129.0, < 136.0< 128.8.0 | 136.0128.8.0 |
When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free