Vulnerability · Published Feb 26, 2021 · Assigned by mozilla
CVE-2021-23969
Medium 4.3
In plain English
A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | firefox | 87.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.21 | firefox | 87.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.22 | firefox | 87.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.23 | firefox | 87.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.20 | firefox-esr | 78.8.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.21 | firefox-esr | 78.8.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.22 | firefox-esr | 78.8.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.23 | firefox-esr | 78.8.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.21 | librewolf | 87.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.22 | librewolf | 87.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.23 | librewolf | 87.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.24 | librewolf | 87.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.20 | thunderbird | 78.9.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.21 | thunderbird | 78.9.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.22 | thunderbird | 78.9.0-r0 | ALPINE-CVE-2021-23969 |
| Alpine:v3.23 | thunderbird | 78.9.0-r0 | ALPINE-CVE-2021-23969 |
| Debian:12 | firefox-esr | 78.8.0esr-1 | DEBIAN-CVE-2021-23969 |
| Debian:13 | firefox-esr | 78.8.0esr-1 | DEBIAN-CVE-2021-23969 |
| Debian:14 | firefox-esr | 78.8.0esr-1 | DEBIAN-CVE-2021-23969 |
| Debian:12 | thunderbird | 1:78.8.0-1 | DEBIAN-CVE-2021-23969 |
| Debian:13 | thunderbird | 1:78.8.0-1 | DEBIAN-CVE-2021-23969 |
| Debian:14 | thunderbird | 1:78.8.0-1 | DEBIAN-CVE-2021-23969 |
| Ubuntu:22.04:LTS | mozjs78 | no fix listed | UBUNTU-CVE-2021-23969 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 86 |
| Mozilla | Thunderbird | < 78.8 |
| Mozilla | Firefox ESR | < 78.8 |
References
- https://www.mozilla.org/security/advisories/mfsa2021-07/ x_refsource_MISC
- https://www.mozilla.org/security/advisories/mfsa2021-09/ x_refsource_MISC
- https://www.mozilla.org/security/advisories/mfsa2021-08/ x_refsource_MISC
- https://bugzilla.mozilla.org/show_bug.cgi?id=1542194 x_refsource_MISC
- [debian-lts-announce] 20210301 [SECURITY] [DLA 2578-1] thunderbird security update mailing-list, x_refsource_MLIST
- DSA-4866 vendor-advisory, x_refsource_DEBIAN
- GLSA-202104-10 vendor-advisory, x_refsource_GENTOO
- GLSA-202104-09 vendor-advisory, x_refsource_GENTOO