PT-2019-4551 · Mozilla+5 · Firefox+5
Hubert Kario
·
Published
2019-07-09
·
Updated
2024-12-12
·
CVE-2019-11727
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 68
Description
The issue is related to an error in the CertificateVerify service of the Network Security Services (NSS), which can be exploited by a remote attacker to impact data integrity. Specifically, it is possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by the server in CertificateRequest in TLS 1.3, although PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages.
Recommendations
For versions prior to 68, update to version 68 or later to resolve the issue. As a temporary workaround, consider restricting the use of TLS 1.3 until a patch is available. Avoid using PKCS#1 v1.5 signatures for TLS 1.3 messages in the affected CertificateVerify service.
Exploit
Fix
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Firefox
Red Hat
Suse
Ubuntu