CVE-2021-29974: Medium severity Mozilla Firefox vulnerability
When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security (which implies that the error should not be override-able.) This issue did not affect the network connections, and they were correctly upgraded to HTTPS automatically.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 90 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 90.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 90.0-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2021-29974?
The severity of CVE-2021-29974 is considered moderate due to its implications on HTTP Strict Transport Security.
How do I fix CVE-2021-29974?
To fix CVE-2021-29974, users should update Firefox to version 90.0 or later.
Which versions of Firefox are affected by CVE-2021-29974?
CVE-2021-29974 affects all versions of Firefox prior to 90.0.
What issue does CVE-2021-29974 introduce regarding TLS error pages?
CVE-2021-29974 allows users to override a TLS error page on domains with HTTP Strict Transport Security enabled.
Is there a workaround for CVE-2021-29974 until I can update?
Currently, the only reliable workaround for CVE-2021-29974 is to disable Enhanced Tracking Protection settings.