CVE-2015-1229 — Google Chrome vulnerability

CWE-197 documents7 sources
Severity
5.0MEDIUMNVD
EPSS
0.3%
top 45.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Google ChromeCanonical Ubuntu LinuxRedhat Enterprise Linux Desktop Supplementary+3 more
Timeline
PublishedMar 9
Latest updateMay 17

Description

net/http/proxy_client_socket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 (aka Proxy Authentication Required) HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages4 packages

▶NVDgoogle/chrome40.0.2214.115

Also affects: Ubuntu Linux 14.04, 14.10, Enterprise Linux 6.6.z

🔴Vulnerability Details

3
GHSA
GHSA-c6rr-q5f7-vrq5: net/http/proxy_client_socket↗2022-05-17
▶
CVEList
CVE-2015-1229: net/http/proxy_client_socket↗2015-03-09
▶
OSV
CVE-2015-1229: net/http/proxy_client_socket↗2015-03-08
▶

📋Vendor Advisories

2
Ubuntu
Oxide vulnerabilities↗2015-03-10
▶
Red Hat
chromium-browser: Cookie injection in proxies↗2015-03-03
▶

💬Community

1
Bugzilla
CVE-2015-1229 chromium-browser: Cookie injection in proxies↗2015-03-04
▶
CVE-2015-1229 — Google Chrome vulnerability | cvebase