CVE-2014-1582
Publication date 14 October 2014
Last updated 24 July 2024
Ubuntu priority
Description
The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address, which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary recognized Certification Authority.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | 14.04 LTS trusty |
Fixed 33.0+build2-0ubuntu0.14.04.1
|
References
Related Ubuntu Security Notices (USN)
- USN-2372-1
- Firefox vulnerabilities
- 14 October 2014