Security researcher Muneaki Nishimura reported that when certificate pinning is set to "strict" mode, a period ('.') appended to a hostname in the address of a site allowed the bypass key pinning (HPKP) and HTTP Strict Transport Security (HSTS). Sites with a period appended were treated as having a different origin than sites without the period. If an attacker had a security certificate for a domain with the added period, this would allow for a Man-in-the-middle (MITM) attack on users. 


External Reference:

https://www.mozilla.org/en-US/security/advisories/mfsa2015-13


Acknowledgements:

Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Muneaki Nishimura as the original reporter.

Statement:

This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.