Vulnerability CVE-2021-23969: Information

Description

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

Severity: MEDIUM (4.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-23969
Published: Feb. 26, 2021
Modified: May 27, 2022

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus86.0-alt1127.0-alt1ALT-PU-2021-1428-1267257Fixed
firefoxp1086.0-alt1118.0.2-alt0.p10.1ALT-PU-2021-1428-1267257Fixed
firefoxp993.0-alt0.p9.1105.0.1-alt0.c9.1ALT-PU-2022-1782-1288073Fixed
firefoxc10f186.0-alt1112.0.2-alt0.p10.1ALT-PU-2021-1428-1267257Fixed
firefoxc9f293.0-alt0.p9.1105.0.1-alt0.c9.1ALT-PU-2021-3368-1288792Fixed
firefoxp1186.0-alt1126.0.1-alt1ALT-PU-2021-1428-1267257Fixed
firefox-esrsisyphus78.8.0-alt1115.11.0-alt1ALT-PU-2021-1396-1266839Fixed
firefox-esrp1091.1.0-alt1115.11.0-alt1ALT-PU-2021-2881-1284980Fixed
firefox-esrp978.8.0-alt0.1.p9102.11.0-alt0.c9.1ALT-PU-2021-1410-1266920Fixed
firefox-esrc10f191.1.0-alt1115.9.1-alt0.c10.1ALT-PU-2021-2881-1284980Fixed
firefox-esrc9f291.3.0-alt1.c9.1102.12.0-alt0.c9.1ALT-PU-2021-3369-1288792Fixed
firefox-esrp1178.8.0-alt1115.11.0-alt1ALT-PU-2021-1396-1266839Fixed
thunderbirdsisyphus78.8.0-alt1115.9.0-alt1ALT-PU-2021-1399-1266955Fixed
thunderbirdp1078.8.0-alt1115.9.0-alt1ALT-PU-2021-1399-1266955Fixed
thunderbirdp978.8.0-alt0.1.p9102.11.0-alt0.c9.1ALT-PU-2021-1430-1266984Fixed
thunderbirdc10f178.8.0-alt1115.9.0-alt0.c10.1ALT-PU-2021-1399-1266955Fixed
thunderbirdc9f278.8.0-alt0.1.c9102.11.0-alt0.c9.1ALT-PU-2021-1418-1267016Fixed
thunderbirdp1178.8.0-alt1115.9.0-alt1ALT-PU-2021-1399-1266955Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1542194
  • Issue Tracking
  • Permissions Required
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-08/
  • Release Notes
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-09/
  • Release Notes
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2021-07/
  • Release Notes
  • Vendor Advisory
[debian-lts-announce] 20210301 [SECURITY] [DLA 2578-1] thunderbird security update
  • Mailing List
  • Third Party Advisory
DSA-4866
  • Third Party Advisory
GLSA-202104-09
  • Third Party Advisory
GLSA-202104-10
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      86.0
      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      End excliding
      78.8
      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      End excliding
      78.8

      Configuration 2

      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top