代码拉取完成，页面将自动刷新
一、漏洞信息
漏洞编号：CVE-2020-26979
漏洞归属组件：firefox
漏洞归属的版本：62.0.3,79.0
CVSS V3.0分值：
BaseScore：6.1 Medium
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
漏洞简述：
When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. This vulnerability affects Firefox < 84.
漏洞公开时间：2021-01-07 22:15
漏洞创建时间：2021-04-07 22:57:20
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2020-26979
漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |
|---|---|---|---|---|
| https://bugzilla.mozilla.org/buglist.cgi?bug_id=1641287%2C1673299 | nvd |
二、漏洞分析结构反馈
影响性分析说明：
When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. This vulnerability affects Firefox < 84.
openEuler评分：
6.1
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP4(79.0):受影响
2.master(115.9.0):不受影响
3.openEuler-22.03-LTS-SP1(102.15.0):不受影响
4.openEuler-22.03-LTS-SP3(102.15.0):不受影响
5.openEuler-22.03-LTS-SP4(102.15.0):不受影响
6.openEuler-24.03-LTS(115.9.0):不受影响
7.openEuler-24.03-LTS-Next(115.9.0):不受影响
修复是否涉及abi变化(是/否)：
1.master(115.9.0):否
2.openEuler-20.03-LTS-SP4(79.0):否
3.openEuler-22.03-LTS-SP1(102.15.0):否
4.openEuler-22.03-LTS-SP3(102.15.0):否
5.openEuler-22.03-LTS-SP4(102.15.0):否
6.openEuler-24.03-LTS(115.9.0):否
7.openEuler-24.03-LTS-Next(115.9.0):否
原因说明：
1.master(115.9.0):
2.openEuler-20.03-LTS-SP4(79.0):
3.openEuler-22.03-LTS-SP1(102.15.0):
4.openEuler-22.03-LTS-SP3(102.15.0):
5.openEuler-22.03-LTS-SP4(102.15.0):
6.openEuler-24.03-LTS(115.9.0):
7.openEuler-24.03-LTS-Next(115.9.0):
三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2320
此处可能存在不合适展示的内容，页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容，可点击提交进行申诉，我们将尽快为您处理。
影响性分析说明：
When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. This vulnerability affects Firefox < 84.
受影响版本排查(受影响/不受影响)：
1.openEuler-20.03-LTS-SP1(79.0): 受影响
2.openEuler-20.03-LTS-SP3(79.0): 受影响
3.openEuler-22.03-LTS(79.0): 受影响
4.openEuler-22.03-LTS-SP1(79.0): 受影响
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(79.0): 是
2.openEuler-20.03-LTS-SP3(79.0): 是
3.openEuler-22.03-LTS(79.0): 是
4.openEuler-22.03-LTS-SP1(79.0): 是
受影响版本排查(受影响/不受影响)：
1.master: 不受影响
2.openEuler-20.03-LTS-SP4: 受影响
3.openEuler-22.03-LTS-SP1: 不受影响
4.openEuler-22.03-LTS-SP3: 不受影响
5.openEuler-22.03-LTS-SP4: 不受影响
6.openEuler-24.03-LTS: 不受影响
7.openEuler-24.03-LTS-Next: 不受影响
修复是否涉及abi变化(是/否)：
1.master: 否
2.openEuler-20.03-LTS-SP4: 否
3.openEuler-22.03-LTS-SP1: 否
4.openEuler-22.03-LTS-SP3: 否
5.openEuler-22.03-LTS-SP4: 否
6.openEuler-24.03-LTS: 否
7.openEuler-24.03-LTS-Next: 否
登录 后才可以发表评论
FileDragTip