CVE-2022-1197: 
NixOS vulnerability analysis and mitigation

CVE-2022-1197 is a security vulnerability discovered in Mozilla Thunderbird affecting versions prior to 91.8. The vulnerability was identified by Thunderbird user Johannes König and was disclosed on April 5, 2022. The issue relates to OpenPGP key management where Thunderbird failed to properly handle revoked keys that specified key compromise as the revocation reason (Mozilla Advisory).

The vulnerability occurs when importing a revoked key that specified key compromise as the revocation reason. In such cases, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. It's important to note that revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected by this vulnerability. The issue has been assigned a moderate severity rating (Mozilla Advisory).

The impact of this vulnerability is considered moderate as it could potentially lead to security issues in OpenPGP key management. When a compromised key is imported, the failure to properly update the revocation status could result in continued trust of a key that should have been marked as compromised (Mozilla Advisory).

The vulnerability affects Thunderbird versions below 91.8. While specific exploit details are not publicly available, the nature of the vulnerability suggests that it could be exploited in scenarios where compromised OpenPGP keys are being processed (NVD).

The vulnerability has been fixed in Thunderbird version 91.8. Users are advised to upgrade to this version or later to address the security issue. No specific workarounds were provided for users unable to upgrade immediately (Mozilla Advisory).