CVE-2021-29974

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1704843
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-28/
• https://security.gentoo.org/glsa/202202-03
• https://www.mozilla.org/security/advisories/mfsa2021-28/

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2021-28

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2021-29970
• CVE-2021-29971
• CVE-2021-30547
• CVE-2021-29972
• CVE-2021-29973
• CVE-2021-29974
• CVE-2021-29975
• CVE-2021-29976
• CVE-2021-29977

Frequently Asked Questions

• What is the severity of CVE-2021-29974?

  The severity of CVE-2021-29974 is considered moderate due to its implications on HTTP Strict Transport Security.

• How do I fix CVE-2021-29974?

  To fix CVE-2021-29974, users should update Firefox to version 90.0 or later.

• Which versions of Firefox are affected by CVE-2021-29974?

  CVE-2021-29974 affects all versions of Firefox prior to 90.0.

• What issue does CVE-2021-29974 introduce regarding TLS error pages?

  CVE-2021-29974 allows users to override a TLS error page on domains with HTTP Strict Transport Security enabled.

• Is there a workaround for CVE-2021-29974 until I can update?

  Currently, the only reliable workaround for CVE-2021-29974 is to disable Enhanced Tracking Protection settings.