CVE-2019-17002: Medium severity Mozilla Firefox vulnerability
If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 70 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 157.0.1-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-17002?
CVE-2019-17002 is a vulnerability in Mozilla Firefox versions up to exclusive 70 where if upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https.
Which software versions are affected by CVE-2019-17002?
Mozilla Firefox versions up to exclusive 70 are affected by CVE-2019-17002.
What is the severity of CVE-2019-17002?
CVE-2019-17002 has a low severity with a severity keyword of 'low' and a severity value of 1.
How can I fix CVE-2019-17002?
To fix CVE-2019-17002, update your Mozilla Firefox browser to a version higher than 70.
Where can I find more information about CVE-2019-17002?
You can find more information about CVE-2019-17002 on the Mozilla Bugzilla page (https://bugzilla.mozilla.org/show_bug.cgi?id=1561056) and the Mozilla security advisory (https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/).