mozilla: certificate verification bypass
| Package(s): | firefox thunderbird seamonkey | CVE #(s): | CVE-2015-0799 | ||||||||||||||||||||||||||||||||||||||||
| Created: | April 6, 2015 | Updated: | September 4, 2015 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
Security researcher Muneaki Nishimura discovered a flaw in the Mozilla's HTTP Alternative Services implementation. If an Alt-Svc header is specified in the HTTP/2 response, SSL certificate verification can be bypassed for the specified alternate server. As a result of this, warnings of invalid SSL certificates will not be displayed and an attacker could potentially impersonate another site through a man-in-the-middle (MTIM), replacing the original certificate with their own. A remote attacker in position of man-in-the-middle can impersonate another site, bypassing certificate validation. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||