CVE-2024-1554: Critical severity Mozilla Firefox vulnerability
Last updated 24 July 2024
Other sources
The fetch() API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers fetch() may contain. Under the correct circumstances, an attacker may have been able to poison the local browser cache by priming it with a fetch() response controlled by the additional headers. Upon navigation to the same URL, the user would see the cached response instead of the expected response. This vulnerability affects Firefox < 123.
— MITRE
The fetch() API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers fetch() may contain. Under the correct circumstances, an attacker may have been able to poison the local browser cache by priming it with a fetch() response controlled by the additional headers. Upon navigation to the same URL, the user would see the cached response instead of the expected response.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 123 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 137.0.2-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-1554?
CVE-2024-1554 is rated as a medium severity vulnerability that affects the caching mechanism of the fetch API in Mozilla Firefox.
How do I fix CVE-2024-1554?
To remediate CVE-2024-1554, update Mozilla Firefox to version 123 or later, or update the debian/firefox package to version 135.0-1.
Which versions of Firefox are affected by CVE-2024-1554?
Mozilla Firefox versions up to 123 are affected by CVE-2024-1554.
What can an attacker do with CVE-2024-1554?
An attacker can potentially poison the local browser cache by manipulating the fetch API under certain conditions.
Is CVE-2024-1554 relevant to Debian Firefox users?
Yes, users of the debian/firefox package should update to version 135.0-1 to mitigate CVE-2024-1554.