[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #20146 [Applications/Tor Browser]: Firefox bug - (CVE-2016-5284) ESR-45/Tor Browser certificate pinning bypass for addons.mozilla.org and other built-in sites
#20146: Firefox bug - (CVE-2016-5284) ESR-45/Tor Browser certificate pinning bypass
for addons.mozilla.org and other built-in sites
--------------------------------------+------------------------------
Reporter: mancha | Owner: tbb-team
Type: defect | Status: needs_review
Priority: Medium | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: tbb-security | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
--------------------------------------+------------------------------
Changes (by gk):
* priority: Immediate => Medium
* severity: Critical => Normal
Comment:
Replying to [comment:13 cypherpunks]:
> What is the state of this bug? It was opened half a year ago and remains
immediate/critical severity level. Has it been mitigated in any other ways
so far?
Yes, the bypass has stopped with updating the pinning lifetime/releasing
new Tor Browser versions. Thus, we can downgrade the severity. We can
probably close this bug but I have to think first how to move the action
items/ideas in this one into other/new bugs.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20146#comment:14>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs