Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
Advisories
Source ID Title
EUVD EUVD EUVD-2009-2059 Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-07T05:36:20.460Z

Reserved: 2009-06-15T00:00:00

Link: CVE-2009-2063

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2009-06-15T19:30:05.547

Modified: 2025-04-09T00:30:58.490

Link: CVE-2009-2063

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses