CVE-2021-38507
Reported by mozilla · Published December 8, 2021
The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on port 80. However, if a second encrypted port on the same IP address (e.g. port 8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin with HTTP. This was resolved by disabling the Opportunistic Encryption feature, which had low usage. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| firefox | Alpine | 94.0-r0 |
| thunderbird | Arch Linux | 91.3.0-1 |
| librewolf | Alpine | 94.0-r0 |
| firefox-esr | Alpine | 91.3.0-r0 |
| thunderbird | Alpine | 91.3.2-r0 |
| firefox | Arch Linux | 94.0-1 |
| firefox | mozilla | 94.0, 94 |
| Thunderbird | Mozilla | 91.3.0, 91.3 |
| Firefox ESR | Mozilla | 91.3 |
| firefox_esr | mozilla | 91.3.0 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | unspecified |
| Mozilla | Thunderbird | unspecified |
| Mozilla | Firefox ESR | unspecified |
| alpine | firefox | 0 |
| arch | thunderbird | 0 |
| alpine | librewolf | 0 |
| Mozilla | Firefox | * |
| Mozilla | Thunderbird | * |
| Mozilla | Firefox ESR | * |
| alpine | firefox-esr | 0 |
| alpine | thunderbird | 0 |
| arch | firefox | 0 |
Timeline
- Nov 3, 2021 CVE Published
- Dec 9, 2021 EPSS Score (30 in total, the first dated here)
- Mar 10, 2026 Distribution Patch (2 in total, the first dated here)
- Mar 10, 2026 Security Advisory (9 in total, the first dated here)
- Jul 25, 2026 Coalition ESS Score
- Sep 20, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2021-38507
vulnetix vdb fixes CVE-2021-38507Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-38507/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_MISC
- x_refsource_MISC
- x_refsource_MISC
- x_refsource_MISC
- DSA-5026 vendor-advisoryx_refsource_DEBIAN
- [debian-lts-announce] 20211229 [SECURITY] [DLA 2863-1] firefox-esr security update mailing-listx_refsource_MLIST
- DSA-5034 vendor-advisoryx_refsource_DEBIAN
- [debian-lts-announce] 20220104 [SECURITY] [DLA 2874-1] thunderbird security update mailing-listx_refsource_MLIST
- GLSA-202202-03 vendor-advisoryx_refsource_GENTOO
- GLSA-202208-14 vendor-advisoryx_refsource_GENTOO