Design/Logic Flaw

2015-02-2511:59:00

PRIOn knowledge base

www.prio-n.com

6.7 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

58.9%

JSON

Mozilla Firefox before 36.0 does not properly recognize the equivalence of domain names with and without a trailing . (dot) character, which allows man-in-the-middle attackers to bypass the HPKP and HSTS protection mechanisms by constructing a URL with this character and leveraging access to an X.509 certificate for a domain with this character.

CPENameOperatorVersion
ubuntu_linuxeq12.04
ubuntu_linuxeq14.10
ubuntu_linuxeq14.04
firefoxeq13.0.1
firefoxeq14.0.1
firefoxeq18.0
firefoxeq0.1
firefoxeq10.0.7
firefoxeq4.0 beta6
firefoxeq4.0 beta1

Name	Operator	Version
ubuntu_linux	eq	12.04
ubuntu_linux	eq	14.10
ubuntu_linux	eq	14.04
firefox	eq	13.0.1
firefox	eq	14.0.1
firefox	eq	18.0
firefox	eq	0.1
firefox	eq	10.0.7
firefox	eq	4.0 beta6
firefox	eq	4.0 beta1