PT-2020-6742 · Mozilla+6 · Firefox+8

Chuck Harmston

+1

·

Published

2020-06-30

·

Updated

2024-12-12

·

CVE-2020-12421

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:C/A:N
Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 68.10 Firefox versions prior to 78 Thunderbird versions prior to 68.10.0
Description The issue is related to errors in the certificate authentication procedure, which could cause add-ons to become out-of-date without user notification. This occurs when certificate chains terminating in non-built-in roots are rejected, even if they were legitimately added by an administrator. The exploitation of this issue may allow a remote attacker to disable installed add-ons.
Recommendations For Firefox ESR versions prior to 68.10, update to version 68.10 or later. For Firefox versions prior to 78, update to version 78 or later. For Thunderbird versions prior to 68.10.0, update to version 68.10.0 or later.

Exploit

Fix

Improper Certificate Validation

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALT-PU-2020-2309
ALT-PU-2020-2408
ALT-PU-2020-2709
ALT-PU-2020-2933
ALT-PU-2020-2934
ALT-PU-2020-3442
ALT-PU-2021-1368
ALT-PU-2021-1369
ALT-PU-2021-3368
BDU:2022-05931
CESA-2020_2824
CESA-2020_2827
CESA-2020_2828
CESA-2020_3038
CVE-2020-12421
DSA-4713-1
DSA-4718-1
MGASA-2020-0274
MGASA-2020-0300
OPENSUSE-SU-2020:0967-1
OPENSUSE-SU-2020:0982-1
OPENSUSE-SU-2020:0983-1
OPENSUSE-SU-2020:1017-1
OPENSUSE-SU-2020_0967-1
OPENSUSE-SU-2020_0982-1
OPENSUSE-SU-2020_0983-1
OPENSUSE-SU-2020_1017-1
OPENSUSE-SU-2024:10600-1
OPENSUSE-SU-2024:10601-1
OPENSUSE-SU-2024:14572-1
RHSA-2020:2824
RHSA-2020:2825
RHSA-2020:2826
RHSA-2020:2827
RHSA-2020:2828
RHSA-2020:2906
RHSA-2020:2907
RHSA-2020:2966
RHSA-2020:3038
RHSA-2020:3046
RHSA-2020_2824
RHSA-2020_2827
RHSA-2020_2828
RHSA-2020_2906
RHSA-2020_2966
RHSA-2020_3038
SUSE-SU-2020:14421-1
SUSE-SU-2020:1898-1
SUSE-SU-2020:1899-1
SUSE-SU-2020:1900-1
USN-4408-1
USN-4421-1

Affected Products

Alt Linux
Centos
Firefox
Firefox Esr
Linuxmint
Red Hat
Suse
Thunderbird
Ubuntu