CVE-2014-1582 — Mozilla Firefox vulnerability

CWE-3107 documents6 sources
Severity
4.3MEDIUMNVD
OSV7.5
EPSS
0.9%
top 24.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mozilla Firefox
Timeline
PublishedOct 15
Latest updateMay 17

Description

The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address, which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary recognized Certification Authority.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶Ubuntumozilla/firefox< 33.0+build2-0ubuntu0.14.04.1
▶NVDmozilla/firefox32.0+3

🔴Vulnerability Details

3
GHSA
GHSA-5853-hwrg-hf3r: The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33↗2022-05-17
▶
OSV
firefox vulnerabilities↗2014-10-14
▶
OSV
CVE-2014-1582: The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33↗2014-10-14
▶

📋Vendor Advisories

2
Ubuntu
Firefox vulnerabilities↗2014-10-14
▶
Red Hat
Mozilla: Key pinning bypasses (MFSA 2014-80)↗2014-10-14
▶

💬Community

1
Bugzilla
CVE-2014-1582 CVE-2014-1584 Mozilla: Key pinning bypasses (MFSA 2014-80)↗2014-10-14
▶