NetSight
IP …
high7.5

CVE-2018-12395

By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting.

Impact

By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Affected products

VendorProductAffected versions
MozillaFirefox
before 63.0
MozillaFirefox Esr
before 60.3
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 18.10
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Eus
Version 7.5
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0

References