CVE-2014-1582

CVE-2014-1582 describes a vulnerability in Mozilla Firefox versions prior to 33.0, where the Public Key Pinning (PKP) implementation could be bypassed. This flaw arose from its failure to account for connection-coalescing behavior in SPDY and HTTP/2, particularly with shared IP addresses. A man-in-the-middle attacker could exploit this to spoof a website using a valid certificate from any recognized Certificate Authority, despite an intended pinning configuration. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity and a potential impact on integrity, but no confidentiality or availability impact. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.