NVD

Id
31409  
Name
CVE-2014-3166  
Description
The Public Key Pinning (PKP) implementation in Google Chrome before 36.0.1985.143 on Windows, OS X, and Linux, and before 36.0.1985.135 on Android, does not correctly consider the properties of SPDY connections, which allows remote attackers to obtain sensitive information by leveraging the use of multiple domain names.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2014-08-13  
Modified Date
2017-01-06  
Seq
2014-3166  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
164470 31409 CVE-2014-3166 http://googlechromereleases.blogspot.com/2014/08/chrome-for-android-update.html  View
164471 31409 CVE-2014-3166 http://googlechromereleases.blogspot.com/2014/08/chrome-for-ios-update.html  View
164472 31409 CVE-2014-3166 http://googlechromereleases.blogspot.com/2014/08/stable-channel-update.html  View
164473 31409 CVE-2014-3166 59693  View
164474 31409 CVE-2014-3166 59904  View
164475 31409 CVE-2014-3166 60685  View
164476 31409 CVE-2014-3166 60798  View
164477 31409 CVE-2014-3166 GLSA-201408-16  View
164478 31409 CVE-2014-3166 DSA-3039  View
164479 31409 CVE-2014-3166 [tls] 20140810 Re: Inter-protocol attacks  View
164480 31409 CVE-2014-3166 69202  View
164481 31409 CVE-2014-3166 1030732  View
164482 31409 CVE-2014-3166 https://code.google.com/p/chromium/issues/detail?id=398925  View
164483 31409 CVE-2014-3166 https://src.chromium.org/viewvc/chrome?revision=286598&view=revision  View
164484 31409 CVE-2014-3166 https://src.chromium.org/viewvc/chrome?revision=288435&view=revision  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14918 JVNDB-2014-003793 Google Chrome の Public Key Pinning の実装における重要な情報を取得される脆弱性 Google Chrome の Public Key Pinning (PKP) の実装は、SPDY connections プロパティを適切に配慮しないため、重要な情報を取得される脆弱性が存在します。 CVE-2014-3166 70453 CVE-2014-3166 31409 5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003793.html 2014-08-12 2014-08-20 View