PT-2014-3158 · Google+1 · Google Chrome+1

Antoine Delignat-Lavaud + 1 · Publicado 2014-02-20 · Atualizado 2024-06-15 · CVE-2013-6659

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 33.0.1750.117

Description The issue concerns the SSLClientSocketNSS::Core::OwnAuthCertHandler function in Google Chrome, which does not prevent changes to server X.509 certificates during renegotiations. This allows remote SSL servers to trigger the use of a new certificate chain by initiating a TLS renegotiation, potentially inconsistent with the user's expectations.

Recommendations For versions prior to 33.0.1750.117, update to version 33.0.1750.117 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

ALT-PU-2014-1282

CVE-2013-6659

DSA-2883-1

MGASA-2014-0107

OPENSUSE-SU-2024:10171-1

OPENSUSE-SU-2024:12948-1

Produtos afetados

Alt Linux

Google Chrome

Referências · 2368

• 🔥 https://github.com/Metnew/uxss-db/tree/master/chrome/CVE-2014-1701 · Exploit
• https://errata.altlinux.org/ALT-PU-2014-1282 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2020-15974 · Nota
• https://suse.com/security/cve/CVE-2019-13742 · Nota
• https://suse.com/security/cve/CVE-2018-6106 · Nota
• https://suse.com/security/cve/CVE-2019-5799 · Nota
• https://suse.com/security/cve/CVE-2022-1497 · Nota
• https://suse.com/security/cve/CVE-2022-2605 · Nota
• https://suse.com/security/cve/CVE-2015-1293 · Nota
• https://suse.com/security/cve/CVE-2019-5801 · Nota
• https://suse.com/security/cve/CVE-2013-0899 · Nota
• https://suse.com/security/cve/CVE-2020-6397 · Nota
• https://suse.com/security/cve/CVE-2022-3449 · Nota
• https://suse.com/security/cve/CVE-2012-2815 · Nota
• https://suse.com/security/cve/CVE-2021-30564 · Nota