CVE-2014-8642: mozilla firefox Cryptographic Issues

Vulnerability summary

CVE-2014-8642 is a medium (CVSS 4.3) Cryptographic Issues vulnerability in mozilla firefox. EPSS estimates a 1.50% chance of exploitation in the next 30 days, higher than 73.8% of scored vulnerabilities.

Timeline

1. 14-01-2015
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the id-pkix-ocsp-nocheck extension in deciding whether to trust an OCSP responder, which makes it easier for remote attackers to obtain sensitive information by sniffing the network during a session in which there was an incorrect decision to accept a compromised and revoked certificate.

• CWE-310Cryptographic IssuesWeaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.