Bug 1885176 (CVE-2020-15665)

Summary:	CVE-2020-15665 firefox: Address bar not reset when choosing to stay on a page after the beforeunload dialog is shown
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jhorak, stransky
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	firefox 80	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-10-06 02:21:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1885183

Description Michael Kaplan 2020-10-05 10:52:49 UTC

Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. This could have resulted in an incorrect URL being shown when used in conjunction with other unexpected browser behaviors. This vulnerability affects Firefox < 80.

References:

https://bugzilla.mozilla.org/show_bug.cgi?id=1651636
https://www.mozilla.org/security/advisories/mfsa2020-36/

Comment 1 Michael Kaplan 2020-10-05 10:52:55 UTC

External References:

https://www.mozilla.org/security/advisories/mfsa2020-36/

Comment 2 Product Security DevOps Team 2020-10-06 02:21:12 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-15665