1058147 - Android HttpClient MITM vulnerability

Status: RESOLVED INCOMPLETE

(Firefox for Android Graveyard :: General, defect, P5)

Description

[Richard Newman [:rnewman]]

http://seclists.org/fulldisclosure/2014/Aug/48

We should explore our options on older Android devices that are vulnerable. I don't think MITM of favicon traffic is critical, but if we use the Android HttpClient layer for update downloads, then :sadface:.

Bug 1058146 covers the use of the ch.boye version in ABS. This bug covers our use of Android's own version in core Fennec.

Comment 1

[Firefox Bug Husbandry Bot]

Re-triaging per https://bugzilla.mozilla.org/show_bug.cgi?id=1473195

Needinfo :susheel if you think this bug should be re-triaged.

Comment 2

[BMO Automation]

We have completed our launch of our new Firefox on Android. The development of the new versions use GitHub for issue tracking. If the bug report still reproduces in a current version of [Firefox on Android nightly](https://play.google.com/store/apps/details?id=org.mozilla.fenix) an issue can be reported at the [Fenix GitHub project](https://github.com/mozilla-mobile/fenix/). If you want to discuss your report please use [Mozilla's chat](https://wiki.mozilla.org/Matrix#Connect_to_Matrix) server https://chat.mozilla.org and join the [#fenix](https://chat.mozilla.org/#/room/#fenix:mozilla.org) channel.