CVE-2014-1584 — Mozilla Firefox vulnerability

CWE-3107 documents6 sources
Severity
4.3MEDIUMNVD
OSV7.5
EPSS
0.7%
top 28.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mozilla Firefox
Timeline
PublishedOct 15
Latest updateMay 17

Description

The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶Ubuntumozilla/firefox< 33.0+build2-0ubuntu0.14.04.1
▶NVDmozilla/firefox32.0+3

🔴Vulnerability Details

3
GHSA
GHSA-vhqr-98f2-rx6h: The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33↗2022-05-17
▶
OSV
firefox vulnerabilities↗2014-10-14
▶
OSV
CVE-2014-1584: The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33↗2014-10-14
▶

📋Vendor Advisories

2
Ubuntu
Firefox vulnerabilities↗2014-10-14
▶
Red Hat
Mozilla: Key pinning bypasses (MFSA 2014-80)↗2014-10-14
▶

💬Community

1
Bugzilla
CVE-2014-1582 CVE-2014-1584 Mozilla: Key pinning bypasses (MFSA 2014-80)↗2014-10-14
▶