Bug 1781986 (CVE-2019-13739)

Summary:	CVE-2019-13739 chromium-browser: Incorrect security UI in Omnibox
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	erack, rhel-process-autobot, tcallawa, tpopela, watson-tool-maintainers, yaneti
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	chromium-browser 79.0.3945.79	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Omnibox component of Chromium. A remote attacker could perform domain spoofing by directing users to a crafted web address using Internationalized Domain Name (IDN) homographs, where characters from different alphabets appear visually identical. This issue allows malicious sites to masquerade as trusted domains in the browser address bar, potentially deceiving users into revealing sensitive information.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-12-16 14:10:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1782011, 1782012, 1782013
Bug Blocks:	1782014

Description Pedro Sampaio 2019-12-11 01:00:53 UTC

An incorrect security ui flaw was found in the Omnibox component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=824715

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

Comment 1 Pedro Sampaio 2019-12-11 01:21:13 UTC

Created chromium tracking bugs for this issue:

Affects: epel-7 [bug 1782013]
Affects: fedora-all [bug 1782012]

Comment 3 errata-xmlrpc 2019-12-16 09:08:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2019:4238 https://access.redhat.com/errata/RHSA-2019:4238

Comment 4 Product Security DevOps Team 2019-12-16 14:10:11 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-13739