PT-2018-3259 · Google+4 · Google Chrome+4

Michał Bentkowski · Published 2018-05-29 · Updated 2024-06-15 · CVE-2018-6148

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 67.0.3396.79

Description The issue is related to an incorrect implementation of Content Security Policy in Google Chrome, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. This is due to the browser's failure to properly handle CRLF sequences, which can be exploited by an attacker to bypass navigation restrictions. The vulnerability affects Google Chrome and potentially other browsers like Opera, due to incorrect handling of CSP headers, allowing attackers to affect the system.

Recommendations For Google Chrome versions prior to 67.0.3396.79, update to version 67.0.3396.79 or later to resolve the issue. For Opera, consider disabling the use of CSP headers until a patch is available. As a temporary workaround, consider restricting the use of HTML pages that could potentially exploit this issue until a patch is available.

Fix

Weakness Enumeration

CWE-93

Related Identifiers

ALT-PU-2018-1959

BDU:2019-04440

CVE-2018-6148

DSA-4237-1

MGASA-2018-0308

OPENSUSE-SU-2018:1859-1

OPENSUSE-SU-2018_1859-1

OPENSUSE-SU-2018_2055-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

RHSA-2018:1825

RHSA-2018_1825

Affected Products

Alt Linux

Google Chrome

Opera

Red Hat

Suse

References · 2330

• https://advisories.mageia.org/MGASA-2018-0308.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-6148 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-6148 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6148 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-6148 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4237-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0308 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04440 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2018:1859-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-6148 · Vendor Advisory
• https://suse.com/security/cve/CVE-2021-21192 · Note
• https://suse.com/security/cve/CVE-2023-0129 · Note