PT-2019-5700 · Mozilla+4 · Network Security Services+4

Published 2019-03-21 · Updated 2021-03-05 · CVE-2019-17007

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Network Security Services versions prior to 3.44

Description The issue is related to a malformed Netscape Certificate Sequence that can cause Network Security Services to crash, resulting in a denial of service. It is also associated with incorrect certificate authentication. An attacker could exploit this to cause a denial of service remotely.

Recommendations For versions prior to 3.44, update to version 3.44 or later to resolve the issue. As a temporary workaround, consider restricting the processing of Netscape Certificate Sequences to minimize the risk of exploitation.

Exploit

Fix

DoS

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2019-1897

ALT-PU-2019-2478

BDU:2021-00100

CESA-2019_1951

CESA-2019_2237

CVE-2019-17007

DLA-2015-1

DLA-2388-1

DSA-4579-1

OESA-2021-1059

RHSA-2019:1951

RHSA-2019:2237

RHSA-2019_1951

RHSA-2019_2237

RHSA-2021:0876

USN-4215-1

Affected Products

Alt Linux

Centos

Network Security Services

Red Hat

Ubuntu

References · 26

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1533216 · Exploit
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=117998111 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-17007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17007 · Security Note
• https://wiki.astralinux.ru/astra-linux-se15-bulletin-20201201SE15 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-17007 · Security Note
• https://osv.dev/vulnerability/OESA-2021-1059 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17007 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4579-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00100 · Security Note
• https://osv.dev/vulnerability/DLA-2388-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12402 · Security Note
• https://osv.dev/vulnerability/DLA-2015-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17007 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17007 · Vendor Advisory