VDB

DEBIAN-CVE-2019-11727

DEBIAN-CVE-2019-11727 PUBLISHED CVSS 5.300000190734863 MEDIUM

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.

Risk Scores

CVSS v3.0
5.300000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected Products

VendorProductVersions
Debian:14nss0, 0, 0
Debian:12nss0, 0, 0
Debian:11nss0, 0, 0
Debian:13nss0, 0, 0

Timeline

  • Jul 23, 2019 CVE Published
  • Apr 28, 2026 CVE Updated
Open in Interactive Console →
$ Console Community · 100/wk Open console ›