CVE-2012-4929

Name of the Vulnerable Software and Affected Versions TLS protocol versions 1.2 and earlier Mozilla Firefox (affected versions not specified) Google Chrome (affected versions not specified) Qt (affected versions not specified)

Description The issue allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, also known as a "CRIME" attack.

Recommendations For TLS protocol versions 1.2 and earlier, consider disabling TLS compression until a patch is available. For Mozilla Firefox, update to a version that properly obfuscates the length of unencrypted data. For Google Chrome, update to a version that properly obfuscates the length of unencrypted data. For Qt, update to a version that properly obfuscates the length of unencrypted data.