CVE-2019-11727
23.07.2019, 14:15
A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.Enginsight
| Vendor | Product | Version |
|---|---|---|
| mozilla | firefox | 𝑥 < 68.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| firefox |
| ||||||||||||||||||||||||||||||
| mozjs38 |
| ||||||||||||||||||||||||||||||
| mozjs52 |
| ||||||||||||||||||||||||||||||
| mozjs60 |
| ||||||||||||||||||||||||||||||
| nss |
| ||||||||||||||||||||||||||||||
| thunderbird |
|
Common Weakness Enumeration
References