CVE-2017-5066 Security feature bypass in Google Chrome prior to 58.0.3029.81 for Mac, Windows and Linux, and 58.0.3029.83 for Android
Remote attackers can bypass certificate validation in Google Chrome by using crafted HTML pages to accept invalid X.509 certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-5066?
CVE-2017-5066 is a medium-severity vulnerability in Google Chrome, published on 27 Oct 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Insufficient consistency checks in signature handling in the networking stack in Google Chrome prior to 58.0.3029.81 for Mac, Windows, and Linux, and 58.0.3029.83 for Android, allowed a remote attacker to incorrectly accept a badly formed X.509 certificate via a crafted HTML page.
Weakness: CWE-347
Which versions are affected by CVE-2017-5066?
It affects 4 products.
Products include Google Chrome, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.
How do I fix CVE-2017-5066?
Upgrade to a fixed version.
Is CVE-2017-5066 being exploited?
There is no known exploitation of CVE-2017-5066 in the wild and no public exploit code.
Other vulnerabilities in Google Chrome
Sources
Also known as GHSA-rj4r-5q3x-jcjp, UBUNTU-CVE-2017-5066.