CVE-2020-26961: 
NixOS vulnerability analysis and mitigation

CVE-2020-26961 is a security vulnerability discovered in Firefox's DNS over HTTPS (DoH) implementation that affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. The vulnerability was reported by Gabriel Corona and disclosed on November 17, 2020. The issue occurs when DoH is in use, where Firefox intentionally filters RFC1918 and related IP ranges from responses, but IPv4 addresses mapped through IPv6 were erroneously allowed through (Mozilla Advisory).

The vulnerability stems from an implementation flaw in Firefox's DoH filtering mechanism. When DNS over HTTPS is enabled, Firefox is designed to filter private IP addresses (RFC1918 ranges) from DNS responses as these addresses should not come from a DoH resolver. However, the filtering mechanism failed to identify and block IPv4 addresses when they were mapped through IPv6 format (e.g., ::ffff:192.168.1.254). The vulnerability was assigned a CVSS v3.1 base score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (NVD).

The vulnerability could lead to potential DNS Rebinding attacks, allowing malicious actors to bypass Firefox's built-in protection against accessing private network resources through DoH. This could potentially expose internal network services to unauthorized access from external websites (Mozilla Advisory, Red Hat).

The vulnerability can be exploited by creating DNS records that return IPv4-mapped IPv6 addresses pointing to private network ranges. When a user visits a malicious website using Firefox with DoH enabled, the attacker could bypass the RFC1918 filtering protection and potentially conduct DNS rebinding attacks against internal network resources (Mozilla Bug).

The vulnerability was fixed in Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5. Users should upgrade to these versions or newer to receive the security fix. The patch ensures that IPv4-mapped IPv6 addresses are properly checked against the RFC1918 ranges when using DoH (Mozilla Advisory).