PT-2014-2020 · Mozilla+3 · Firefox+3
Muneaki Nishimura
·
Publicado
2014-09-29
·
Atualizado
2024-12-12
·
CVE-2017-7789
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 55
Description
The issue is related to the implementation of the Strict Transport Security (HSTS) mechanism in Mozilla Firefox, which fails to properly neutralize special elements in output used by an incoming component. This could allow a remote attacker to compromise data integrity. If a server sends two Strict-Transport-Security (STS) headers for a single connection, they will be rejected as invalid and HTTP Strict Transport Security (HSTS) will not be enabled for the connection.
Recommendations
For versions prior to 55, update to version 55 or later to resolve the issue. As a temporary workaround, consider restricting the use of HSTS until the update is applied. Avoid using multiple Strict-Transport-Security headers in a single connection to minimize the risk of exploitation.
Exploit
Correção
Special Elements Injection
Improper Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Suse
Ubuntu