Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Mozilla Firefox/Google Chrome TLS协议加密问题漏洞
Vulnerability Description
TLS用于在两个通信应用程序之间提供保密性和数据完整性。 Mozilla Firefox，Google Chrome及其他多个产品使用的TLS协议1.2和之前版本中存在漏洞，该漏洞源于执行压缩数据加密时未能正确模糊未加密数据的长度。中间人攻击者可通过提交一系列猜测请求，观察到压缩数据长度的变化(也称CRIME攻击)来获取明文HTTP头信息，造成敏感信息泄露(如cookie信息)。
CVSS Information
N/A
Vulnerability Type
N/A