CVE-2017-5120
Fixed in a distro release EPSS 1%
Inappropriate use of www mismatch redirects in browser navigation in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to potentially downgrade HTTPS requests to HTTP via a crafted HTML page. In other words, Chrome could transmit cleartext even though the user had entered an https URL, because of a misdesigned workaround for cases where the domain name in a URL almost matches the domain name in an X.509 server certificate (but differs in the initial "www." substring).
Products: google chrome, debian_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | chromium | 61.0.3163.79-1 |
| Debian 9 | chromium-browser | 61.0.3163.100-1~deb9u1 |
| Red Hat rhel extras 6 | chromium-browser | 0:61.0.3163.79-2.el6_9 |
| Red Hat rhel extras 6 | chromium-browser-debuginfo | 0:61.0.3163.79-2.el6_9 |
| SUSE Package Hub 12 SP2 | chromium | 61.0.3163.79-29.1 |
| Ubuntu 14.04 LTS | chromium-browser | 61.0.3163.100-0ubuntu0.14.04.1202 |
| Ubuntu 16.04 LTS | chromium-browser | 61.0.3163.100-0ubuntu0.16.04.1306 |
| Ubuntu 16.04 LTS | oxide-qt | no fix |
| Ubuntu 18.04 LTS | chromium-browser | 61.0.3163.100-0ubuntu1.1378 |
| openSUSE Tumbleweed | chromium | 93.0.4577.82-1.1 |
| openSUSE Tumbleweed | chromium | 113.0.5672.92-1.1 |