CVE-2019-11727
First published: Tue Jul 09 2019(Updated: )
A vulnerability exists where it possible to force Network Security Services (NSS) to sign `CertificateVerify` with PKCS#1 v1.5 signatures when those are the only ones advertised by server in `CertificateRequest` in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. External Reference: <a href="https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727">https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727</a>
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/nspr | <0:4.25.0-2.el7_9 | 0:4.25.0-2.el7_9 |
| redhat/nss | <0:3.53.1-3.el7_9 | 0:3.53.1-3.el7_9 |
| redhat/nss-softokn | <0:3.53.1-6.el7_9 | 0:3.53.1-6.el7_9 |
| redhat/nss-util | <0:3.53.1-1.el7_9 | 0:3.53.1-1.el7_9 |
| redhat/nspr | <0:4.21.0-2.el8_0 | 0:4.21.0-2.el8_0 |
| redhat/nss | <0:3.44.0-7.el8_0 | 0:3.44.0-7.el8_0 |
| Mozilla Thunderbird | <68 | 68 |
| redhat/nss | <3.44.1 | 3.44.1 |
| Mozilla Firefox | <68 | 68 |
| Mozilla Firefox | <68.0 | |
| IBM Cognos Analytics | <=12.0.0-12.0.3 | |
| IBM Cognos Analytics | <=11.2.0-11.2.4 FP4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2019-11727 https://nvd.nist.gov/vuln/detail/CVE-2019-11727 https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727
- https://bugzilla.redhat.com/show_bug.cgi?id=1730988
- https://access.redhat.com/errata/RHSA-2020:4076
- https://access.redhat.com/errata/RHSA-2019:1951
- https://access.redhat.com/security/cve/cve-2019-11727
- https://bugzilla.mozilla.org/show_bug.cgi?id=1552208
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-28/
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727
- https://hg.mozilla.org/projects/nss/rev/17c6fc2ec3c1feaed56ef59b35bf435c7d5c4949
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html
- https://security.gentoo.org/glsa/201908-12
- https://www.mozilla.org/security/advisories/mfsa2019-21/
- https://www.ibm.com/support/pages/node/7177223 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2019-11727?
CVE-2019-11727 is a vulnerability in Network Security Services (NSS) that allows for the signing of CertificateVerify with PKCS#1 v1.5 signatures in TLS 1.3 messages.
How severe is CVE-2019-11727?
CVE-2019-11727 has a severity rating of 5.3 (medium).
Which software is affected by CVE-2019-11727?
The software affected by CVE-2019-11727 includes Mozilla Thunderbird, Firefox, and Red Hat NSS.
How can I fix CVE-2019-11727?
To fix CVE-2019-11727, update your software to the recommended versions: Red Hat NSS 3.44.1, Mozilla Thunderbird 68, Mozilla Firefox 68.
Where can I find more information about CVE-2019-11727?
You can find more information about CVE-2019-11727 on the Mozilla and Red Hat security advisories.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/author
- collector/mozilla-advisory
- source/Mozilla
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-11727
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- agent/event
- collector/ibm-support
- source/IBM
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/trending
- package-manager/redhat
- vendor/mozilla
- canonical/mozilla thunderbird
- canonical/mozilla firefox
- vendor/ibm
- canonical/ibm cognos analytics
- version/ibm cognos analytics/12.0.0-12.0.3
- version/ibm cognos analytics/11.2.0-11.2.4 fp4