Mozilla Firefox before 36.0 does not properly recognize the equivalence of domain names with and without a trailing . (dot) character, which allows man-in-the-middle attackers to bypass the HPKP and HSTS protection mechanisms by constructing a URL with this character and leveraging access to an X.509 certificate for a domain with this character.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2015-02-25T11:00:00

Updated: 2024-08-06T04:26:11.059Z

Reserved: 2015-01-07T00:00:00

Link: CVE-2015-0832

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2015-02-25T11:59:12.720

Modified: 2018-10-30T16:27:35.843

Link: CVE-2015-0832

cve-icon Redhat

Severity : Moderate

Publid Date: 2015-02-24T00:00:00Z

Links: CVE-2015-0832 - Bugzilla