When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2020-24/#CVE-2020-12424
Acknowledgments: Name: the Mozilla project Upstream: Paul Theriault
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-12424
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:3555 https://access.redhat.com/errata/RHSA-2020:3555
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:3557 https://access.redhat.com/errata/RHSA-2020:3557
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:3559 https://access.redhat.com/errata/RHSA-2020:3559
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:4080 https://access.redhat.com/errata/RHSA-2020:4080