CVE-2019-11727
Summary
| CVE | CVE-2019-11727 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-07-23 14:15:00 UTC |
| Updated | 2019-07-30 23:15:00 UTC |
| Description | A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68. |
Risk And Classification
Problem Types: CWE-295
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security vulnerabilities fixed in Firefox 68 — Mozilla | MISC | www.mozilla.org | Vendor Advisory |
| Mozilla Firefox: Multiple vulnerabilities (GLSA 201908-12) — Gentoo security | GENTOO | security.gentoo.org | |
| [security-announce] openSUSE-SU-2019:2251-1: important: Security update | SUSE | lists.opensuse.org | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| Access Denied | MISC | bugzilla.mozilla.org | Issue Tracking, Permissions Required, Vendor Advisory |
| [security-announce] openSUSE-SU-2019:2249-1: important: Security update | SUSE | lists.opensuse.org | |
| [security-announce] openSUSE-SU-2020:0008-1: moderate: Security update f | SUSE | lists.opensuse.org | |
| [security-announce] openSUSE-SU-2019:2260-1: important: Security update | SUSE | lists.opensuse.org | |
| [security-announce] openSUSE-SU-2019:2248-1: important: Security update | SUSE | lists.opensuse.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 296080 Oracle Solaris 11.4 Support Repository Update (SRU) 13.4.0 Missing (CPUJUL2019)
- 352469 Amazon Linux Security Advisory for nspr, nss-softokn, nss-util: ALAS-2021-1522
- 377524 Alibaba Cloud Linux Security Update for nss and nspr (ALINUX2-SA-2020:0173)
- 710148 Gentoo Linux Mozilla Firefox Multiple vulnerabilities (GLSA 201908-12)