CVE-2014-1582 in Firefox
要約 (英語)
The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address, which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary recognized Certification Authority.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
予約する
2014年01月16日
公開
2014年10月15日
ステータス
確認済み
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 67798 | Mozilla Firefox SPDY/HTTP/2 弱い暗号化 | 310 | 未実証 | 公式な修正 | CVE-2014-1582 |