Vulnerability · Published Aug 5, 2021 · Assigned by mozilla

CVE-2021-29974

Medium 4.3

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.3Medium

Exploit odds (30 days)0.8%top 42.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security (which implies that the error should not be override-able.) This issue did not affect the network connections, and they were correctly upgraded to HTTPS automatically. This vulnerability affects Firefox < 90.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	firefox	90.0-r0	ALPINE-CVE-2021-29974
Alpine:v3.21	firefox	90.0-r0	ALPINE-CVE-2021-29974
Alpine:v3.22	firefox	90.0-r0	ALPINE-CVE-2021-29974
Alpine:v3.23	firefox	90.0-r0	ALPINE-CVE-2021-29974
Alpine:v3.21	librewolf	90.0-r0	ALPINE-CVE-2021-29974
Alpine:v3.22	librewolf	90.0-r0	ALPINE-CVE-2021-29974
Alpine:v3.23	librewolf	90.0-r0	ALPINE-CVE-2021-29974
Alpine:v3.24	librewolf	90.0-r0	ALPINE-CVE-2021-29974
Ubuntu:22.04:LTS	mozjs78	no fix listed	UBUNTU-CVE-2021-29974

Affected products (as reported)

Vendor	Product	Versions
Mozilla	Firefox	unspecified – before 90

References

https://www.mozilla.org/security/advisories/mfsa2021-28/ x_refsource_MISC
https://bugzilla.mozilla.org/show_bug.cgi?id=1704843 x_refsource_MISC
GLSA-202202-03 vendor-advisory, x_refsource_GENTOO