PT-2019-4551 · Mozilla+5 · Firefox+5
Hubert Kario
·
Publicado
2019-07-09
·
Atualizado
2024-12-12
·
CVE-2019-11727
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 68
Description
The issue is related to an error in the CertificateVerify service of the Network Security Services (NSS), which can be exploited by a remote attacker to impact data integrity. Specifically, it is possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by the server in CertificateRequest in TLS 1.3, although PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages.
Recommendations
For versions prior to 68, update to version 68 or later to resolve the issue. As a temporary workaround, consider restricting the use of TLS 1.3 until a patch is available. Avoid using PKCS#1 v1.5 signatures for TLS 1.3 messages in the affected CertificateVerify service.
Exploit
Correção
Improper Certificate Validation
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Firefox
Red Hat
Suse
Ubuntu