Security features bypass in Mozilla Firefox and Firefox for Android - CVE-2022-45419

Vulnerability identifier: #VU69334

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-45419

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the way Firefox handles deletion of a security exception granted for an invalid TLS certificate. If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted.

Mozilla Firefox
Firefox for Android
Gentoo Linux
Ubuntu
openEuler
www-client/firefox
firefox (Ubuntu package)
firefox
firefox-debuginfo
firefox-debugsource

Install updates from vendor's website.

Mozilla Firefox - update to 107.0
Firefox for Android - update to 107.1.0
www-client/firefox - update to 104
firefox (Ubuntu package) - addressed in versions 107.0+build2-0ubuntu0.18.04.1, 107.0+build2-0ubuntu0.20.04.1
firefox - update to 128.8.0-1
firefox-debuginfo - update to 128.8.0-1
firefox-debugsource - update to 128.8.0-1

• https://www.mozilla.org/en-US/security/advisories/mfsa2022-47/

• Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
• Ubuntu update for firefox
• Gentoo update for Mozilla Firefox
• openEuler 22.03 LTS SP4 update for firefox
• openEuler 22.03 LTS SP3 update for firefox