Cryptographic Issues Affecting chromium-browser package, versions <33.0.1750.152-0ubuntu0.12.04.1~pkg879.1


Severity

Recommended
0.0
medium
0
10

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.13% (49th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cryptographic Issues vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-UBUNTU1204-CHROMIUMBROWSER-412105
  • published24 Feb 2014
  • disclosed24 Feb 2014

Introduced: 24 Feb 2014

CVE-2013-6659  (opens in a new tab)
CWE-310  (opens in a new tab)

How to fix?

Upgrade Ubuntu:12.04 chromium-browser to version 33.0.1750.152-0ubuntu0.12.04.1~pkg879.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream chromium-browser package and not the chromium-browser package as distributed by Ubuntu. See How to fix? for Ubuntu:12.04 relevant fixed versions and status.

The SSLClientSocketNSS::Core::OwnAuthCertHandler function in net/socket/ssl_client_socket_nss.cc in Google Chrome before 33.0.1750.117 does not prevent changes to server X.509 certificates during renegotiations, which allows remote SSL servers to trigger use of a new certificate chain, inconsistent with the user's expectations, by initiating a TLS renegotiation.

CVSS Scores

version 3.1