PT-2022-3283 · Mozilla+2 · Firefox For Android+2
Peter Gerber
·
Published
2022-06-28
·
Updated
2024-12-12
·
CVE-2022-34469
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Firefox for Android versions prior to 102
Description
The issue is related to the handling of TLS Certificate errors on domains protected by the HSTS header. When such an error occurs, the browser should prevent the user from bypassing the certificate error. However, on Firefox for Android, users were given the option to bypass the error, which could only be done explicitly by the user. This could potentially allow a remote attacker to execute arbitrary code by exploiting the vulnerability in the TLS certificate authentication procedure.
Recommendations
For Firefox for Android versions prior to 102, update to version 102 or later to resolve the issue. As a temporary workaround, consider avoiding domains with TLS certificate errors to minimize the risk of exploitation. Restrict access to sensitive information when using Firefox for Android until the update is applied.
Exploit
Fix
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Firefox For Android
Suse