The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mozilla
Published: 2014-10-15T10:00:00
Updated: 2024-08-06T09:42:36.662Z
Reserved: 2014-01-16T00:00:00
Link: CVE-2014-1584
Vulnrichment
No data.
NVD
Status : Modified
Published: 2014-10-15T10:55:06.990
Modified: 2016-12-22T02:59:14.077
Link: CVE-2014-1584
Redhat