Description
The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.
References (10)
Core 10
Core References
Issue Tracking x_refsource_confirm
https://code.google.com/p/chromium/issues/detail?id=455215
Various Sources vendor-advisory
x_refsource_ubuntu
http://ubuntu.com/usn/usn-2570-1
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2015/dsa-3238
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201506-04
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1032209
Various Sources x_refsource_confirm
https://chromium.googlesource.com/chromium/src/net/+/2359906c4fdfa9d44b045755d23fe5327c10e010
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html
Release Notes, Vendor Advisory x_refsource_confirm
http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0816.html
Scores
EPSS
0.0144
EPSS Percentile
70.1%
Details
CWE
CWE-200
Status
published
Products (5)
canonical/ubuntu_linux
14.04
canonical/ubuntu_linux
14.10
canonical/ubuntu_linux
15.04
debian/debian_linux
8.0
google/chrome
< 42.0.2311.60
Published
Apr 19, 2015
Tracked Since
Feb 18, 2026