CVE-2022-34471: 
NixOS vulnerability analysis and mitigation

CVE-2022-34471 is a moderate severity vulnerability discovered in Firefox that affects the browser's addon update mechanism. The vulnerability was reported by Rob Wu and fixed in Firefox 102, released on June 28, 2022. The issue affects Mozilla Firefox's addon update verification process (Mozilla Advisory).

The vulnerability stems from a verification flaw where the downloaded addon update's version was not properly verified against the version selected from the manifest. When downloading an update for an addon, the browser failed to verify that the downloaded addon update's version matched the version selected from the manifest (Mozilla Advisory, Mozilla Bug).

If the manifest had been tampered with on the server, an attacker could exploit this vulnerability to trick the browser into downgrading an addon to a prior version. This could potentially expose users to security vulnerabilities that were present in older versions of the addon (Mozilla Advisory).

The vulnerability was fixed in Firefox 102. Users should update to Firefox version 102 or later to receive the security fix. The fix includes implementing verification checks to ensure that the downloaded addon version matches the version selected from the manifest (Ubuntu Security).