CVE-2022-34472 - Vulnerability Details

Vendors	Products
Mozilla	Firefox Firefox Esr Thunderbird
Redhat	Enterprise Linux Rhel E4s Rhel Eus

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 7
firefox-0:91.11.0-2.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:5479	2022-07-01T00:00:00Z
thunderbird-0:91.11.0-2.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:5480	2022-07-01T00:00:00Z
Red Hat Enterprise Linux 8
firefox-0:91.11.0-2.el8_6	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:5469	2022-06-30T00:00:00Z
thunderbird-0:91.11.0-2.el8_6	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:5470	2022-06-30T00:00:00Z
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
firefox-0:91.11.0-2.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:5477	2022-06-30T00:00:00Z
thunderbird-0:91.11.0-2.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:5478	2022-06-30T00:00:00Z
Red Hat Enterprise Linux 8.2 Extended Update Support
firefox-0:91.11.0-2.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:5474	2022-07-01T00:00:00Z
thunderbird-0:91.11.0-2.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:5475	2022-07-01T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support
firefox-0:91.11.0-2.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:5472	2022-06-30T00:00:00Z
thunderbird-0:91.11.0-2.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:5473	2022-06-30T00:00:00Z
Red Hat Enterprise Linux 9
firefox-0:91.11.0-2.el9_0	cpe:/a:redhat:enterprise_linux:9	RHSA-2022:5481	2022-07-01T00:00:00Z
thunderbird-0:91.11.0-2.el9_0	cpe:/a:redhat:enterprise_linux:9	RHSA-2022:5482	2022-07-01T00:00:00Z

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1770123
https://nvd.nist.gov/vuln/detail/CVE-2022-34472
https://www.cve.org/CVERecord?id=CVE-2022-34472
https://www.mozilla.org/en-US/security/advisories/mfsa2022-25/#CVE-2022-34472
https://www.mozilla.org/security/advisories/mfsa2022-24/
https://www.mozilla.org/security/advisories/mfsa2022-25/
https://www.mozilla.org/security/advisories/mfsa2022-26/

Type	Values Removed	Values Added
Weaknesses		CWE-703
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-34472", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "dateUpdated": "2025-04-15T19:41:32.614Z", "dateReserved": "2022-06-24T00:00:00.000Z", "datePublished": "2022-12-22T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2022-12-22T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11."}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"version": "unspecified", "lessThan": "102", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"version": "unspecified", "lessThan": "91.11", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"version": "unspecified", "lessThan": "102", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThan": "91.11", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-24/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-26/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-25/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1770123"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Unavailable PAC file resulted in OCSP requests being blocked"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:15:15.230Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-24/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-26/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-25/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1770123", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-703", "lang": "en", "description": "CWE-703 Improper Check or Handling of Exceptional Conditions"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-15T19:41:27.799667Z", "id": "CVE-2022-34472", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-15T19:41:32.614Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-34472 (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

assignerShortName : mozilla (string)

dateUpdated : 2025-04-15T19:41:32.614Z (string)

dateReserved : 2022-06-24T00:00:00.000Z (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2022-12-22T00:00:00.000Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. (string)

}

]

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 102 (string)

status : affected (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 91.11 (string)

status : affected (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 102 (string)

status : affected (string)

versionType : custom (string)

}

1 : { »

version : unspecified (string)

lessThan : 91.11 (string)

status : affected (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-24/ (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-26/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-25/ (string)

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1770123 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : Unavailable PAC file resulted in OCSP requests being blocked (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T09:15:15.230Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-24/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-26/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-25/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1770123 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-703 (string)

lang : en (string)

description : CWE-703 Improper Check or Handling of Exceptional Conditions (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-15T19:41:27.799667Z (string)

id : CVE-2022-34472 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-15T19:41:32.614Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-24/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-26/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-25/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1770123", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:15:15.230Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-34472", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-15T19:41:27.799667Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-703", "description": "CWE-703 Improper Check or Handling of Exceptional Conditions"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-15T19:41:10.998Z"}}], "cna": {"affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "102", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "91.11", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "102", "versionType": "custom"}, {"status": "affected", "version": "unspecified", "lessThan": "91.11", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-24/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-26/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-25/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1770123"}], "descriptions": [{"lang": "en", "value": "If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Unavailable PAC file resulted in OCSP requests being blocked"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2022-12-22T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-34472", "state": "PUBLISHED", "dateUpdated": "2025-04-15T19:41:32.614Z", "dateReserved": "2022-06-24T00:00:00.000Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2022-12-22T00:00:00.000Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-24/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-26/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-25/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1770123 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T09:15:15.230Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2022-34472 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-15T19:41:27.799667Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-703 (string)

description : CWE-703 Improper Check or Handling of Exceptional Conditions (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-15T19:41:10.998Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 102 (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 91.11 (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 102 (string)

versionType : custom (string)

}

1 : { »

status : affected (string)

version : unspecified (string)

lessThan : 91.11 (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-24/ (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-26/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-25/ (string)

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1770123 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : Unavailable PAC file resulted in OCSP requests being blocked (string)

}

]

}

]

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2022-12-22T00:00:00.000Z (string)

}

cveMetadata : { »

cveId : CVE-2022-34472 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-15T19:41:32.614Z (string)

dateReserved : 2022-06-24T00:00:00.000Z (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

assignerShortName : mozilla (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "D117FB2D-9780-4CCE-BAD9-AC6A81500598", "versionEndExcluding": "102.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "745BD6E6-FF51-4F43-B3C5-A53E9D77DCB7", "versionEndExcluding": "91.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "897D6E98-A21E-4D5A-A4E8-64073F667C0A", "versionEndExcluding": "91.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11."}, {"lang": "es", "value": "Si hubiera una URL de PAC configurada y no se pudiera acceder al servidor que aloja el PAC, las solicitudes de OCSP se habr\u00edan bloqueado, lo que provocar\u00eda que se mostraran p\u00e1ginas de error incorrectas. Esta vulnerabilidad afecta a Firefox &lt; 102, Firefox ESR &lt; 91.11, Thunderbird &lt; 102 y Thunderbird &lt; 91.11."}], "id": "CVE-2022-34472", "lastModified": "2025-04-15T20:15:36.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-22T20:15:31.723", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1770123"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-24/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-25/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-26/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1770123"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-24/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-25/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-26/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-703"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D117FB2D-9780-4CCE-BAD9-AC6A81500598 (string)

versionEndExcluding : 102.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 745BD6E6-FF51-4F43-B3C5-A53E9D77DCB7 (string)

versionEndExcluding : 91.11 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 897D6E98-A21E-4D5A-A4E8-64073F667C0A (string)

versionEndExcluding : 91.11 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. (string)

}

1 : { »

lang : es (string)

value : Si hubiera una URL de PAC configurada y no se pudiera acceder al servidor que aloja el PAC, las solicitudes de OCSP se habrían bloqueado, lo que provocaría que se mostraran páginas de error incorrectas. Esta vulnerabilidad afecta a Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102 y Thunderbird < 91.11. (string)

}

]

id : CVE-2022-34472 (string)

lastModified : 2025-04-15T20:15:36.803 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2022-12-22T20:15:31.723 (string)

references : [ »

0 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Issue Tracking (string)

1 : Permissions Required (string)

2 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1770123 (string)

}

1 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-24/ (string)

}

2 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-25/ (string)

}

3 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-26/ (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Permissions Required (string)

2 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1770123 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-24/ (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-25/ (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-26/ (string)

}

]

sourceIdentifier : security@mozilla.org (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-703 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"acknowledgement": "Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Laurent Bigonville as the original reporter.", "affected_release": [{"advisory": "RHSA-2022:5479", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:91.11.0-2.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-07-01T00:00:00Z"}, {"advisory": "RHSA-2022:5480", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:91.11.0-2.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-07-01T00:00:00Z"}, {"advisory": "RHSA-2022:5469", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:91.11.0-2.el8_6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-06-30T00:00:00Z"}, {"advisory": "RHSA-2022:5470", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:91.11.0-2.el8_6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-06-30T00:00:00Z"}, {"advisory": "RHSA-2022:5477", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "firefox-0:91.11.0-2.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-06-30T00:00:00Z"}, {"advisory": "RHSA-2022:5478", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "thunderbird-0:91.11.0-2.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-06-30T00:00:00Z"}, {"advisory": "RHSA-2022:5474", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "firefox-0:91.11.0-2.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-07-01T00:00:00Z"}, {"advisory": "RHSA-2022:5475", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "thunderbird-0:91.11.0-2.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-07-01T00:00:00Z"}, {"advisory": "RHSA-2022:5472", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "firefox-0:91.11.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-06-30T00:00:00Z"}, {"advisory": "RHSA-2022:5473", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "thunderbird-0:91.11.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-06-30T00:00:00Z"}, {"advisory": "RHSA-2022:5481", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "firefox-0:91.11.0-2.el9_0", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-07-01T00:00:00Z"}, {"advisory": "RHSA-2022:5482", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "thunderbird-0:91.11.0-2.el9_0", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-07-01T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Unavailable PAC file resulted in OCSP requests being blocked", "id": "2102166", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2102166"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-393", "details": ["If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.", "A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that if a PAC URL was set and the server that hosts the PAC was not reachable, OCSP requests are blocked, resulting in incorrect error pages being shown."], "name": "CVE-2022-34472", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2022-06-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-34472\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-34472\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-25/#CVE-2022-34472"], "threat_severity": "Moderate"}

{

acknowledgement : Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Laurent Bigonville as the original reporter. (string)

affected_release : [ »

0 : { »

advisory : RHSA-2022:5479 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : firefox-0:91.11.0-2.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-07-01T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2022:5480 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : thunderbird-0:91.11.0-2.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-07-01T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2022:5469 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : firefox-0:91.11.0-2.el8_6 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-06-30T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2022:5470 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : thunderbird-0:91.11.0-2.el8_6 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-06-30T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2022:5477 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : firefox-0:91.11.0-2.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-06-30T00:00:00Z (string)

}

5 : { »

advisory : RHSA-2022:5478 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : thunderbird-0:91.11.0-2.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-06-30T00:00:00Z (string)

}

6 : { »

advisory : RHSA-2022:5474 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : firefox-0:91.11.0-2.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-07-01T00:00:00Z (string)

}

7 : { »

advisory : RHSA-2022:5475 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : thunderbird-0:91.11.0-2.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-07-01T00:00:00Z (string)

}

8 : { »

advisory : RHSA-2022:5472 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : firefox-0:91.11.0-2.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-06-30T00:00:00Z (string)

}

9 : { »

advisory : RHSA-2022:5473 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : thunderbird-0:91.11.0-2.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-06-30T00:00:00Z (string)

}

10 : { »

advisory : RHSA-2022:5481 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : firefox-0:91.11.0-2.el9_0 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2022-07-01T00:00:00Z (string)

}

11 : { »

advisory : RHSA-2022:5482 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : thunderbird-0:91.11.0-2.el9_0 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2022-07-01T00:00:00Z (string)

}

]

bugzilla : { »

description : Mozilla: Unavailable PAC file resulted in OCSP requests being blocked (string)

id : 2102166 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2102166 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 6.1 (string)

cvss3_scoring_vector : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

status : verified (string)

}

cwe : CWE-393 (string)

details : [ »

0 : If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. (string)

1 : A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that if a PAC URL was set and the server that hosts the PAC was not reachable, OCSP requests are blocked, resulting in incorrect error pages being shown. (string)

]

name : CVE-2022-34472 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : firefox (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

1 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : thunderbird (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

]

public_date : 2022-06-28T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2022-34472 https://nvd.nist.gov/vuln/detail/CVE-2022-34472 https://www.mozilla.org/en-US/security/advisories/mfsa2022-25/#CVE-2022-34472 (string)

]

threat_severity : Moderate (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object