CVE-2019-11727 — Improper Certificate Validation in Mozilla Firefox

CWE-295 — Improper Certificate ValidationCWE-327 — Use of a Broken or Risky Cryptographic Algorithm12 documents7 sources
Severity
5.3MEDIUMNVD
OSV9.8OSV7.5
EPSS
0.2%
top 51.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla FirefoxMozilla NSSDebian Firefox+1 more
Timeline
PublishedJul 23
Latest updateMay 24

Description

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages7 packages

▶debiandebian/firefox< firefox 68.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 68
▶NVDmozilla/firefox< 68.0
▶Ubuntumozilla/firefox< 68.0+build3-0ubuntu0.16.04.1+3
▶debiandebian/nss< firefox 68.0-1 (sid)

🔴Vulnerability Details

5
GHSA
GHSA-pwq5-w788-7w28: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1↗2022-05-24
▶
OSV
firefox regressions↗2019-07-25
▶
OSV
CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1↗2019-07-23
▶
OSV
nss vulnerabilities↗2019-07-16
▶
OSV
firefox vulnerabilities↗2019-07-12
▶

📋Vendor Advisories

5
Ubuntu
Firefox regressions↗2019-07-25
▶
Ubuntu
NSS vulnerabilities↗2019-07-16
▶
Ubuntu
Firefox vulnerabilities↗2019-07-12
▶
Red Hat
nss: PKCS#1 v1.5 signatures can be used for TLS 1.3↗2019-07-09
▶
Debian
CVE-2019-11727: firefox - A vulnerability exists where it possible to force Network Security Services (NSS...↗2019
▶

💬Community

1
Bugzilla
CVE-2019-11727 nss: PKCS#1 v1.5 signatures can be used for TLS 1.3↗2019-07-18
▶