OESA-2021-1059 (CVE-2019-17006)
Vulnerability from osv_openeuler – Published: 2021-03-05 11:04 – Updated: 2026-08-06 11:04 – Source websiteNetwork Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.
Security Fix(es):
In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.(CVE-2019-17006)
In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.(CVE-2019-17007)
A use-after-free flaw was found in Mozilla Network Security Services (NSS) related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS.(CVE-2019-11756)
A flaw was found in NSS, where it is vulnerable to RSA key generation cache timing side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. The highest threat to this flaw is to confidentiality.(CVE-2020-12402)
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"nss-3.54.0-2.oe1.aarch64.rpm",
"nss-devel-3.54.0-2.oe1.aarch64.rpm",
"nss-debuginfo-3.54.0-2.oe1.aarch64.rpm",
"nss-debugsource-3.54.0-2.oe1.aarch64.rpm",
"nss-softokn-3.54.0-2.oe1.aarch64.rpm",
"nss-softokn-devel-3.54.0-2.oe1.aarch64.rpm",
"nss-util-3.54.0-2.oe1.aarch64.rpm",
"nss-util-devel-3.54.0-2.oe1.aarch64.rpm"
],
"src": [
"nss-3.54.0-2.oe1.src.rpm"
],
"x86_64": [
"nss-devel-3.54.0-2.oe1.x86_64.rpm",
"nss-3.54.0-2.oe1.x86_64.rpm",
"nss-debugsource-3.54.0-2.oe1.x86_64.rpm",
"nss-debuginfo-3.54.0-2.oe1.x86_64.rpm",
"nss-softokn-3.54.0-2.oe1.x86_64.rpm",
"nss-softokn-devel-3.54.0-2.oe1.x86_64.rpm",
"nss-util-3.54.0-2.oe1.x86_64.rpm",
"nss-util-devel-3.54.0-2.oe1.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:20.03-LTS",
"name": "nss",
"purl": "pkg:rpm/openEuler/nss\u0026distro=openEuler-20.03-LTS"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.54.0-2.oe1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Critical"
},
"details": "Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.(CVE-2019-17006)\r\n\r\nIn Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.(CVE-2019-17007)\n\nA use-after-free flaw was found in Mozilla Network Security Services (NSS) related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS.(CVE-2019-11756)\n\nA flaw was found in NSS, where it is vulnerable to RSA key generation cache timing side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. The highest threat to this flaw is to confidentiality.(CVE-2020-12402)",
"id": "OESA-2021-1059",
"modified": "2026-08-06T11:04:17Z",
"published": "2021-03-05T11:04:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1059"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17006"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17007"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11756"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12402"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "nss security update",
"upstream": [
"CVE-2019-17006",
"CVE-2019-17007",
"CVE-2019-11756",
"CVE-2020-12402"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.