CVE-2019-11727: Medium severity IBM Cognos Analytics vulnerability

Q: What is CVE-2019-11727?

CVE-2019-11727 is a vulnerability in Network Security Services (NSS) that allows for the signing of CertificateVerify with PKCS#1 v1.5 signatures in TLS 1.3 messages.

Q: How severe is CVE-2019-11727?

CVE-2019-11727 has a severity rating of 5.3 (medium).

Q: Which software is affected by CVE-2019-11727?

The software affected by CVE-2019-11727 includes Mozilla Thunderbird, Firefox, and Red Hat NSS.

Q: How can I fix CVE-2019-11727?

To fix CVE-2019-11727, update your software to the recommended versions: Red Hat NSS 3.44.1, Mozilla Thunderbird 68, Mozilla Firefox 68.

Q: Where can I find more information about CVE-2019-11727?

You can find more information about CVE-2019-11727 on the Mozilla and Red Hat security advisories.

Published Jul 9, 2019

Updated

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages.

External Reference:

https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727

Other sources

— Mozilla

Mozilla Firefox could allow a remote attacker to bypass security restrictions. By persuading a victim to visit a specially-crafted Web site, an attacker could exploit this vulnerability to force Network Security Services (NSS) to sign PKCS#1 v1.5 signatures to be used for TLS 1.3 messages.

— IBM

Affected Software

12 affected componentsFixes available

redhat/nspr<0:4.25.0-2.el7_9

0:4.25.0-2.el7_9

redhat/nss<0:3.53.1-3.el7_9

0:3.53.1-3.el7_9

redhat/nss-softokn<0:3.53.1-6.el7_9

0:3.53.1-6.el7_9

redhat/nss-util<0:3.53.1-1.el7_9

0:3.53.1-1.el7_9

redhat/nspr<0:4.21.0-2.el8_0

0:4.21.0-2.el8_0

redhat/nss<0:3.44.0-7.el8_0

0:3.44.0-7.el8_0

redhat/nss<3.44.1

3.44.1

IBM Cognos Analytics<=12.0.0-12.0.3

IBM Cognos Analytics<=11.2.0-11.2.4 FP4

Mozilla Thunderbird<68

Mozilla Firefox<68

Mozilla Firefox<68.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/nspr to a version that resolves this vulnerability.
Fixed in 0:4.25.0-2.el7_9
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 0:3.53.1-3.el7_9
Upgrade
Upgrade redhat/nss-softokn to a version that resolves this vulnerability.
Fixed in 0:3.53.1-6.el7_9
Upgrade
Upgrade redhat/nss-util to a version that resolves this vulnerability.
Fixed in 0:3.53.1-1.el7_9
Upgrade
Upgrade redhat/nspr to a version that resolves this vulnerability.
Fixed in 0:4.21.0-2.el8_0
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 0:3.44.0-7.el8_0
Upgrade
Upgrade redhat/nss to a version that resolves this vulnerability.
Fixed in 3.44.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 68
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 68
Upgrade
Upgrade Mozilla Firefox to a version that resolves this vulnerability.
Fixed in 68

Event History

Jul 9, 2019

CVE Published

12:00 AM

Jul 23, 2019

CVE Published

via MITRE·01:16 PM

Data Sourced

via MITRE·01:16 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2019-11727?