Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 31 May 2011 14:41:44 +0200
From: Thomas Biege <>
Subject: CVE request: firefox doesn't (re)validate certificates when loading HTTPS page

found this in RH's bugzilla:

Vincent Danen 2011-05-30 18:38:43 EDT

A Debian bug report [1] indicated that Firefox 4.0.x handled the
validation/revalidation of SSL certificates improperly.  If a user were to
visit a site with an untrusted certificate, Firefox would correctly display the
warning about the untrusted connection.  If a user were to confirm the security
exception for a single session (not check off the "permanently store this
exception"), then restart the browser and re-load the page, the contents of the
page would be displayed from the Firefox cache.  Upon reloading the page, the
security warning would appear, but incorrectly indicates that the site provides
a valid, verified certificate and there is no way to confirm the exception.

Thomas Biege <>, SUSE LINUX, Security Support & Auditing
SUSE LINUX GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imend├Ârffer, HRB 21284 (AG N├╝rnberg
  Wer aufhoert besser werden zu wollen, hoert auf gut zu sein.
                            -- Marie von Ebner-Eschenbach

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.