The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mozilla
Published: 2014-10-15T10:00:00
Updated: 2016-12-20T16:57:01
Reserved: 2014-01-16T00:00:00
Link: CVE-2014-1584
JSON object: View
NVD Information
Status : Modified
Published: 2014-10-15T10:55:06.990
Modified: 2016-12-22T02:59:14.077
Link: CVE-2014-1584
JSON object: View
Redhat Information
No data.
CWE