Log in Start free

Vulnerability · Published Dec 8, 2021 · Assigned by mozilla

CVE-2021-38507

Medium 6.5

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.8%top 42.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on port 80. However, if a second encrypted port on the same IP address (e.g. port 8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin with HTTP. This was resolved by disabling the Opportunistic Encryption feature, which had low usage. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox91.3.0-1.el8_4.almaALSA-2021:4123
AlmaLinux:8thunderbird91.3.0-2.el8_4.almaALSA-2021:4130
AlmaLinux:8thunderbird91.3.0-2.el8_4.alma.plusALSA-2021:4130
Alpine:v3.20firefox94.0-r0ALPINE-CVE-2021-38507
Alpine:v3.21firefox94.0-r0ALPINE-CVE-2021-38507
Alpine:v3.22firefox94.0-r0ALPINE-CVE-2021-38507
Alpine:v3.23firefox94.0-r0ALPINE-CVE-2021-38507
Alpine:v3.20firefox-esr91.3.0-r0ALPINE-CVE-2021-38507
Alpine:v3.21firefox-esr91.3.0-r0ALPINE-CVE-2021-38507
Alpine:v3.22firefox-esr91.3.0-r0ALPINE-CVE-2021-38507
Alpine:v3.23firefox-esr91.3.0-r0ALPINE-CVE-2021-38507
Alpine:v3.21librewolf94.0-r0ALPINE-CVE-2021-38507
Alpine:v3.22librewolf94.0-r0ALPINE-CVE-2021-38507
Alpine:v3.23librewolf94.0-r0ALPINE-CVE-2021-38507
Alpine:v3.24librewolf94.0-r0ALPINE-CVE-2021-38507
Alpine:v3.20thunderbird91.3.2-r0ALPINE-CVE-2021-38507
Alpine:v3.21thunderbird91.3.2-r0ALPINE-CVE-2021-38507
Alpine:v3.22thunderbird91.3.2-r0ALPINE-CVE-2021-38507
Alpine:v3.23thunderbird91.3.2-r0ALPINE-CVE-2021-38507
Debian:12firefox-esr91.3.0esr-1DEBIAN-CVE-2021-38507
Debian:13firefox-esr91.3.0esr-1DEBIAN-CVE-2021-38507
Debian:14firefox-esr91.3.0esr-1DEBIAN-CVE-2021-38507
Debian:12thunderbird1:91.3.0-1DEBIAN-CVE-2021-38507
Debian:13thunderbird1:91.3.0-1DEBIAN-CVE-2021-38507
Debian:14thunderbird1:91.3.0-1DEBIAN-CVE-2021-38507
Rocky Linux:8firefox0:91.3.0-1.el8RLSA-2021:4123
Rocky Linux:8thunderbird0:91.3.0-2.el8RLSA-2021:4130
Rocky Linux:8thunderbird0:91.3.0-2.el8_4RLSA-2021:4130
Ubuntu:22.04:LTSfirefox94.0+build3-0ubuntu1UBUNTU-CVE-2021-38507
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2021-38507
Ubuntu:22.04:LTSthunderbird1:91.3.1+build1-0ubuntu1UBUNTU-CVE-2021-38507

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 94
Mozilla Thunderbird unspecified – before 91.3
Mozilla Firefox ESR unspecified – before 91.3

References