CVE-2022-34472

What it actually does

When a PAC URL is configured and its server is unreachable, the browser fails to perform OCSP checks and surfaces incorrect certificate error pages instead of the proper validation outcome.

Why it matters to the business

Users may encounter misleading security warnings or skipped certificate validation feedback, causing minor user confusion and potential support overhead; the issue has been public for nearly four years with negligible observed exploitation.

How an attack unfolds

An attacker would need to control or influence network conditions so that a victim's configured PAC server becomes unreachable while the victim visits a site whose certificate status the attacker wishes to obscure; the resulting blocked OCSP requests cause the browser to display a generic or incorrect error page rather than a proper certificate warning.

How to fix it

Upgrade Firefox to 102 or later, Firefox ESR to 91.11 or later, Thunderbird to 102 or later, and Thunderbird ESR to 91.11 or later; ensure PAC servers remain reachable or remove the PAC configuration if it is no longer required.

How to confirm the fix worked

Confirm the installed product versions meet or exceed the fixed releases; test by temporarily making the PAC server unreachable and verifying that OCSP checks still complete with the correct certificate status results.

Typical attack path

1. Identify targets that have a PAC URL configured in their browser or mail client.
2. Make the PAC server unreachable (network manipulation, DNS interference, or DoS).
3. Serve a site or email with a certificate whose OCSP status would normally be checked.
4. Observe or induce the display of an incorrect error page that masks the real certificate state.

How to detect it

Review browser and mail client update logs and configuration inventories for versions older than the fixed releases; no runtime exploitation artifacts are expected given the nature of the flaw.

What your security team should do

• Apply the version upgrades listed above to all affected Mozilla products.
• Audit enterprise browser and mail client configurations for unnecessary PAC settings.
• Monitor EPSS and KEV updates; treat as low priority given the four-year publication age and minimal exploit maturity.