CVE-2021-29974: Medium severity firefox vulnerability
When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security (which implies that the error should not be override-able.) This issue did not affect the network connections, and they were correctly upgraded to HTTPS automatically.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2021-29974?
The severity of CVE-2021-29974 is considered moderate due to its implications on HTTP Strict Transport Security.
How do I fix CVE-2021-29974?
To fix CVE-2021-29974, users should update Firefox to version 90.0 or later.
Which versions of Firefox are affected by CVE-2021-29974?
CVE-2021-29974 affects all versions of Firefox prior to 90.0.
What issue does CVE-2021-29974 introduce regarding TLS error pages?
CVE-2021-29974 allows users to override a TLS error page on domains with HTTP Strict Transport Security enabled.
Is there a workaround for CVE-2021-29974 until I can update?
Currently, the only reliable workaround for CVE-2021-29974 is to disable Enhanced Tracking Protection settings.