Bug 1932109 (CVE-2021-23969)

Summary:	CVE-2021-23969 Mozilla: Content Security Policy violation report could have contained the destination of a redirect
Product:	[Other] Security Response	Reporter:	Doran Moppert <dmoppert>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	cschalle, erack, jhorak, nobody, stransky, tpopela
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	firefox 78.8, thunderbird 78.8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-02-24 19:02:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1930750, 1930751, 1930752, 1930753, 1930754, 1931640, 1931641, 1931642, 1931643, 1931644
Bug Blocks:	1930748

Description Doran Moppert 2021-02-24 01:19:11 UTC

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that's not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin.



External Reference:

https://www.mozilla.org/en-US/security/advisories/mfsa2021-08/#CVE-2021-23969

Comment 1 Doran Moppert 2021-02-24 01:19:15 UTC

Acknowledgments:

Name: the Mozilla project
Upstream: Masato Kinugawa

Comment 2 errata-xmlrpc 2021-02-24 14:59:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0655 https://access.redhat.com/errata/RHSA-2021:0655

Comment 3 errata-xmlrpc 2021-02-24 15:30:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:0659 https://access.redhat.com/errata/RHSA-2021:0659

Comment 4 errata-xmlrpc 2021-02-24 15:31:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0657 https://access.redhat.com/errata/RHSA-2021:0657

Comment 5 errata-xmlrpc 2021-02-24 15:32:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:0658 https://access.redhat.com/errata/RHSA-2021:0658

Comment 6 errata-xmlrpc 2021-02-24 15:40:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0660 https://access.redhat.com/errata/RHSA-2021:0660

Comment 7 errata-xmlrpc 2021-02-24 15:40:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0656 https://access.redhat.com/errata/RHSA-2021:0656

Comment 8 errata-xmlrpc 2021-02-24 15:46:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0662 https://access.redhat.com/errata/RHSA-2021:0662

Comment 9 errata-xmlrpc 2021-02-24 15:58:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:0661 https://access.redhat.com/errata/RHSA-2021:0661

Comment 10 Product Security DevOps Team 2021-02-24 19:02:44 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-23969