CVE-2015-1269

The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames…

published June 26, 2015

CVSS
—
EPSS
2%
Percentile
77.5
In the wild
Unconfirmed
What it is

The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string that (1) ends in a . (dot) character or (2) is not entirely lowercase.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01745 · 77.5th percentile
Published
2015-06-26T14:00Z
EPSS history
Timeline
  • 26 JUN 14:00Z
    The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames…
    cvelistv5