CVE-2023-6135

Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 41%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
< 121.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
bookworm
ignored
bullseye
ignored
buster
ignored
sid
133.0.3-1
fixed
nss
bookworm
ignored
bookworm (security)
vulnerable
bullseye
ignored
bullseye (security)
vulnerable
buster
ignored
sid
2:3.106-1
fixed
trixie
2:3.106-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
bionic
ignored
focal
Fixed 121.0+build1-0ubuntu0.20.04.1
released
jammy
not-affected
lunar
ignored
mantic
not-affected
noble
not-affected
oracular
not-affected
trusty
ignored
xenial
ignored
mozjs102
bionic
dne
focal
dne
jammy
ignored
lunar
ignored
mantic
ignored
noble
ignored
oracular
dne
trusty
dne
xenial
dne
mozjs38
bionic
ignored
focal
dne
jammy
dne
lunar
dne
mantic
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
mozjs52
bionic
ignored
focal
ignored
jammy
dne
lunar
dne
mantic
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
mozjs68
bionic
dne
focal
ignored
jammy
dne
lunar
dne
mantic
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
mozjs78
bionic
dne
focal
dne
jammy
ignored
lunar
ignored
mantic
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
mozjs91
bionic
dne
focal
dne
jammy
ignored
lunar
dne
mantic
dne
noble
dne
oracular
dne
trusty
dne
xenial
dne
nss
bionic
needs-triage
focal
Fixed 2:3.98-0ubuntu0.20.04.1
released
jammy
Fixed 2:3.98-0ubuntu0.22.04.1
released
lunar
ignored
mantic
Fixed 2:3.98-0ubuntu0.23.10.1
released
noble
not-affected
oracular
not-affected
trusty
ignored
xenial
needs-triage
thunderbird
bionic
ignored
focal
not-affected
jammy
not-affected
lunar
ignored
mantic
not-affected
noble
not-affected
oracular
not-affected
trusty
ignored
xenial
ignored
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
nspr
RHEL 9
0:4.35.0-6.el9_3
fixed
nspr-devel
RHEL 9
0:4.35.0-6.el9_3
fixed
nss
RHEL 8
0:3.90.0-6.el8_9
fixed
RHEL 8.8 AUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 E4S
0:3.90.0-6.el8_8
fixed
RHEL 8.8 EUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 TUS
0:3.90.0-6.el8_8
fixed
RHEL 9
0:3.90.0-6.el9_3
fixed
nss-devel
RHEL 8
0:3.90.0-6.el8_9
fixed
RHEL 8.8 AUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 E4S
0:3.90.0-6.el8_8
fixed
RHEL 8.8 EUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 TUS
0:3.90.0-6.el8_8
fixed
RHEL 9
0:3.90.0-6.el9_3
fixed
nss-softokn
RHEL 8
0:3.90.0-6.el8_9
fixed
RHEL 8.8 AUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 E4S
0:3.90.0-6.el8_8
fixed
RHEL 8.8 EUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 TUS
0:3.90.0-6.el8_8
fixed
RHEL 9
0:3.90.0-6.el9_3
fixed
nss-softokn-devel
RHEL 8
0:3.90.0-6.el8_9
fixed
RHEL 8.8 AUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 E4S
0:3.90.0-6.el8_8
fixed
RHEL 8.8 EUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 TUS
0:3.90.0-6.el8_8
fixed
RHEL 9
0:3.90.0-6.el9_3
fixed
nss-softokn-freebl
RHEL 8
0:3.90.0-6.el8_9
fixed
RHEL 8.8 AUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 E4S
0:3.90.0-6.el8_8
fixed
RHEL 8.8 EUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 TUS
0:3.90.0-6.el8_8
fixed
RHEL 9
0:3.90.0-6.el9_3
fixed
nss-softokn-freebl-devel
RHEL 8
0:3.90.0-6.el8_9
fixed
RHEL 8.8 AUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 E4S
0:3.90.0-6.el8_8
fixed
RHEL 8.8 EUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 TUS
0:3.90.0-6.el8_8
fixed
RHEL 9
0:3.90.0-6.el9_3
fixed
nss-sysinit
RHEL 8
0:3.90.0-6.el8_9
fixed
RHEL 8.8 AUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 E4S
0:3.90.0-6.el8_8
fixed
RHEL 8.8 EUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 TUS
0:3.90.0-6.el8_8
fixed
RHEL 9
0:3.90.0-6.el9_3
fixed
nss-tools
RHEL 8
0:3.90.0-6.el8_9
fixed
RHEL 8.8 AUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 E4S
0:3.90.0-6.el8_8
fixed
RHEL 8.8 EUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 TUS
0:3.90.0-6.el8_8
fixed
RHEL 9
0:3.90.0-6.el9_3
fixed
nss-util
RHEL 8
0:3.90.0-6.el8_9
fixed
RHEL 8.8 AUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 E4S
0:3.90.0-6.el8_8
fixed
RHEL 8.8 EUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 TUS
0:3.90.0-6.el8_8
fixed
RHEL 9
0:3.90.0-6.el9_3
fixed
nss-util-devel
RHEL 8
0:3.90.0-6.el8_9
fixed
RHEL 8.8 AUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 E4S
0:3.90.0-6.el8_8
fixed
RHEL 8.8 EUS
0:3.90.0-6.el8_8
fixed
RHEL 8.8 TUS
0:3.90.0-6.el8_8
fixed
RHEL 9
0:3.90.0-6.el9_3
fixed
Common Weakness Enumeration
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1853908
https://security.gentoo.org/glsa/202401-10
https://www.mozilla.org/security/advisories/mfsa2023-56/
https://bugzilla.mozilla.org/show_bug.cgi?id=1853908
https://security.gentoo.org/glsa/202401-10
https://www.mozilla.org/security/advisories/mfsa2023-56/