PT-2021-14420 · Brave · Brave

Newfunction · Published 2021-02-23 · Updated 2022-01-07 · CVE-2021-21323

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Brave versions 1.17.73 through 1.20.103

Description The issue concerns the CNAME adblocking feature in Brave, which was added in version 1.17.73. This feature accidentally initiated DNS requests that bypassed the Brave Tor proxy. As a result, users with adblocking enabled would leak DNS requests from Tor windows to their DNS provider. DNS requests not initiated by CNAME adblocking would still go through Tor as expected.

Recommendations For versions 1.17.73 through 1.20.103, update to version 1.20.108 to resolve the issue. As a temporary workaround, consider disabling the CNAME adblocking feature until the update to version 1.20.108 is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-21323

GHSA-MQJF-9X5G-2RV6

Affected Products

Brave

References · 10

• https://github.com/brave/brave-browser/issues/13527 · Patch
• https://github.com/brave/brave-core/commit/12fe321eaad8acc1cbd1d70b4128f687777bcf15 · Patch
• https://github.com/brave/brave-core/pull/7769 · Patch
• https://osv.dev/vulnerability/CVE-2021-21323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21323 · Security Note
• https://github.com/brave/brave-browser/security/advisories/GHSA-mqjf-9x5g-2rv6 · Note
• https://t.me/cvenotify/10402 · Telegram Post
• https://t.me/cvenotify/25122 · Telegram Post
• https://hackerone.com/reports/1077022 · Note
• https://t.me/cibsecurity/24045 · Telegram Post