HTTP response splitting in Mozilla Firefox and Mozilla Thunderbird - CVE-2021-29991

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU55935

HTTP response splitting in Mozilla Firefox and Mozilla Thunderbird - CVE-2021-29991

Published: August 18, 2021


Vulnerability identifier: #VU55935
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-29991
CWE-ID: CWE-113
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform HTTP splitting attacks.

The vulnerability exists due to the affected software incorrectly accepts a newline in a HTTP/3 header, interpretting it as two separate headers. A remote attacker can perform a header splitting attack against servers using HTTP/3.


Affected software

Mozilla Firefox
Mozilla Thunderbird
SUSE CaaS Platform
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Workstation Extension
Ubuntu
firefox (Ubuntu package)
MozillaFirefox
MozillaFirefox-debuginfo
MozillaFirefox-debugsource
MozillaFirefox-devel
MozillaFirefox-translations-common
MozillaFirefox-translations-other
MozillaThunderbird-translations-common
MozillaThunderbird-translations-other
MozillaThunderbird
MozillaThunderbird-debuginfo
MozillaThunderbird-debugsource
MozillaFirefox-branding-SLE
thunderbird (Ubuntu package)
MozillaFirefox-branding-SLED

How to mitigate CVE-2021-29991

Install updates from vendor's website.

Mozilla Firefox - update to 91.0.1
Mozilla Thunderbird - update to 91.0.1
firefox (Ubuntu package) - addressed in versions 91.0.1+build1-0ubuntu0.18.04.1, 91.0.1+build1-0ubuntu0.20.04.1, 91.0.1+build1-0ubuntu0.21.04.1
MozillaFirefox - addressed in versions 91.1.0-112.71.1, 91.2.0-3.155.2, 91.2.0-8.54.1, 91.2.0-78.143.1, 91.9.0-112.104.1, 91.9.0-150000.150.34.1
MozillaFirefox-debuginfo - addressed in versions 91.1.0-112.71.1, 91.2.0-3.155.2, 91.2.0-8.54.1, 91.2.0-78.143.1, 91.9.0-112.104.1, 91.9.0-150000.150.34.1
MozillaFirefox-debugsource - addressed in versions 91.1.0-112.71.1, 91.2.0-3.155.2, 91.2.0-8.54.1, 91.9.0-112.104.1, 91.9.0-150000.150.34.1
MozillaFirefox-devel - addressed in versions 91.1.0-112.71.1, 91.2.0-3.155.2, 91.2.0-8.54.1, 91.9.0-112.104.1, 91.9.0-150000.150.34.1
MozillaFirefox-translations-common - addressed in versions 91.1.0-112.71.1, 91.2.0-3.155.2, 91.2.0-8.54.1, 91.2.0-78.143.1, 91.9.0-112.104.1, 91.9.0-150000.150.34.1
MozillaFirefox-translations-other - addressed in versions 91.2.0-3.155.2, 91.2.0-8.54.1, 91.2.0-78.143.1, 91.9.0-150000.150.34.1
MozillaThunderbird-translations-common - update to 91.4.0-8.45.2
MozillaThunderbird-translations-other - update to 91.4.0-8.45.2
MozillaThunderbird - update to 91.4.0-8.45.2
MozillaThunderbird-debuginfo - update to 91.4.0-8.45.2
MozillaThunderbird-debugsource - update to 91.4.0-8.45.2
MozillaFirefox-branding-SLE - addressed in versions 91-4.19.1, 91-9.5.1, 91-35.6.6
thunderbird (Ubuntu package) - addressed in versions 1:91.5.0+build1-0ubuntu0.18.04.1, 1:91.5.0+build1-0ubuntu0.20.04.1
MozillaFirefox-branding-SLED - update to 91-21.18.1

External References

Related Security Bulletins