Red Hat Bugzilla – Bug 1252294
CVE-2015-4490 Mozilla: Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification (MFSA 2015-91)
Last modified: 2015-11-24 07:23:48 EST
Mozilla security engineer Christoph Kerschbaumer reported a discrepancy in Mozilla's implementation of Content Security Policy and the CSP specification. The specification states that blob:, data:, and filesystem: URLs should be excluded in case of a wildcard when matching source expressions but Mozilla's implementation allows these in the case of an asterisk wildcard. This could allow for more permissive CSP usage than expected by a web developer, possibly allowing for cross-site scripting (XSS) attacks.
Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Christoph Kerschbaumer as the original reporter.
This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.