CVE-2022-31742: Medium severity Mozilla Firefox vulnerability
An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have led to cross-origin account linking in violation of WebAuthn goals.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 101 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 101 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 91.10 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 101.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 91.10.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 101.0-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 91.10.0-r0 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.10.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:91.10.0-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-31742?
CVE-2022-31742 has been classified with a severity level that may allow for potential cross-origin account linking exploits.
How do I fix CVE-2022-31742?
To remediate CVE-2022-31742, update affected Mozilla products such as Firefox, Firefox ESR, and Thunderbird to fixed versions 101 or 91.10.
Which software is affected by CVE-2022-31742?
CVE-2022-31742 affects Mozilla Firefox versions earlier than 101, Firefox ESR versions earlier than 91.10, and Thunderbird versions earlier than 91.10.
What types of attacks are associated with CVE-2022-31742?
CVE-2022-31742 is associated with timing attacks that could exploit vulnerabilities in handling allowCredential entries.
What are the potential consequences of CVE-2022-31742?
The exploitation of CVE-2022-31742 could lead to cross-origin account linking, undermining WebAuthn goals.