CVE-2021-23969

CVE Details

Release Date:

2021-02-26

Description

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that's not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

See more information about CVE-2021-23969 from MITRE CVE dictionary and NIST NVD

CVSS v3.0 metrics

NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.

Base Score:	4.3	Base Metrics:	AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Access Vector:	Network	Attack Complexity:	Low
Privileges Required:	None	User Interaction:	Required
Scope:	Unchanged	Confidentiality Impact:	Low
Integrity Impact:	None	Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (firefox)	ELSA-2021-0656	2021-02-26
Oracle Linux version 7 (thunderbird)	ELSA-2021-0661	2021-02-26
Oracle Linux version 8 (firefox)	ELSA-2021-0655	2021-02-26
Oracle Linux version 8 (thunderbird)	ELSA-2021-0657	2021-02-26

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team