CVE-2025-0239CWE-295

CVE-2025-0239

Medium · published January 7, 2025

CVSS v3.1

4.0

EPSS

Percentile

12.7

In the wild

Unconfirmed

What it is

When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

The record

Technical detail

CVSS v3.1: 4.0 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00227 · 12.7th percentile
Weakness: CWE-295 · Improper Certificate Validation
Published: 2025-01-07T21:15Z

Affected products (4)

Product	Versions	Fixed in
mozilla/firefox	< 128.6.0	128.6.0
mozilla/firefox	< 134.0	134.0
mozilla/thunderbird	< 128.6.0	128.6.0
mozilla/thunderbird	≥ 129.0, < 134.0	134.0

References (6)

https://bugzilla.mozilla.org/show_bug.cgi?id=1929156 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-01/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-02/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-04/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-05/ · [email protected]https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

07 JAN 16:07Z
Alt-Svc ALPN validation failure when redirected
cvelistv5