If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content. External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/#CVE-2019-11737
Acknowledgments: Name: the Mozilla project Upstream: Xiaoyin Liu
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-11737