PT-2017-3237 · Google+3 · Google Chrome+3
Publicado
2017-04-19
·
Atualizado
2024-06-15
·
CVE-2017-5066
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 58.0.3029.81 for Mac, Windows, and Linux
Google Chrome version prior to 58.0.3029.83 for Android
Description
The issue is related to insufficient consistency checks in signature handling in the networking stack, allowing a remote attacker to incorrectly accept a badly formed X.509 certificate via a crafted HTML page. This could be achieved by exploiting the vulnerability with a specially crafted HTML page, potentially leading to the establishment of an incorrectly formed X.509 certificate.
Recommendations
For Google Chrome versions prior to 58.0.3029.81 for Mac, Windows, and Linux, update to version 58.0.3029.81 or later.
For Google Chrome version prior to 58.0.3029.83 for Android, update to version 58.0.3029.83 or later.
As a temporary workaround, consider restricting the use of X.509 certificates in the affected browser versions until a patch is available.
Exploit
Correção
RCE
Improper Verification of Cryptographic Signature
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Google Chrome
Opera
Red Hat
Suse