CVE-2020-12421

Description

The Mozilla Foundation Security Advisory describes this flaw as:

When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score6.16.5N/A
Attack VectorNetworkNetworkN/A
Attack ComplexityLowLowN/A
Privileges RequiredNoneNoneN/A
User InteractionRequiredRequiredN/A
ScopeChangedUnchangedN/A
ConfidentialityLowNoneN/A
Integrity ImpactLowHighN/A
Availability ImpactNoneNoneN/A

Vector

Red Hat: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Understanding the Weakness (CWE)

CWE-296

Non-Repudiation

Technical Impact: Hide Activities

Exploitation of this flaw can lead to the trust of data that may have originated with a spoofed source.

Integrity,Confidentiality,Availability,Access Control

Technical Impact: Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands

Data, requests, or actions taken by the attacking entity can be carried out as a spoofed benign entity.

Acknowledgements

Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Chuck Harmston and Robert Hardy as the original reporters.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.