https://bugzilla.mozilla.org/show_bug.cgi?id=1590001

USN-4234-1

USN-4397-1

DSA-4726

https://www.mozilla.org/security/advisories/mfsa2020-01/

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has nss packages installed that are affected by multiple vulnerabilities:

  - A vulnerability exists where it possible to force Network Security Services (NSS) to sign     CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in     CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This     vulnerability affects Firefox < 68. (CVE-2019-11727)

  - When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger     an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information     disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
    (CVE-2019-11719)

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71. (CVE-2019-11756)

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72. (CVE-2019-17023)

  - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78. (CVE-2020-12402)

  - When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which     leaked partial information about the nonce used during signature generation. Given an electro-magnetic     trace of a few signature generations, the private key could have been computed. This vulnerability affects     Firefox < 80 and Firefox for Android < 80. (CVE-2020-6829)

  - During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar     multiplication was removed, resulting in variable-time execution dependent on secret data. This     vulnerability affects Firefox < 80 and Firefox for Android < 80. (CVE-2020-12401)

  - When converting coordinates from projective to affine, the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80     and Firefox for Android < 80. (CVE-2020-12400)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has nss packages installed that are affected by multiple vulnerabilities:

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71. (CVE-2019-11756)

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72. (CVE-2019-17023)

  - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78. (CVE-2020-12402)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:3280 advisory.

  - nss: Use-after-free in sftk_FreeSession due to improper refcounting (CVE-2019-11756)

  - nss: Check length of inputs for cryptographic primitives (CVE-2019-17006)

  - nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state (CVE-2019-17023)

  - nss: Side channel vulnerabilities during RSA key generation (CVE-2020-12402)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1559 advisory.

  - When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger     an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information     disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
    (CVE-2019-11719)

  - A vulnerability exists where it possible to force Network Security Services (NSS) to sign     CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in     CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This     vulnerability affects Firefox < 68. (CVE-2019-11727)

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71. (CVE-2019-11756)

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72. (CVE-2019-17023)

  - When converting coordinates from projective to affine, the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80     and Firefox for Android < 80. (CVE-2020-12400)

  - During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar     multiplication was removed, resulting in variable-time execution dependent on secret data. This     vulnerability affects Firefox < 80 and Firefox for Android < 80. (CVE-2020-12401)

  - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78. (CVE-2020-12402)

  - When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which     leaked partial information about the nonce used during signature generation. Given an electro-magnetic     trace of a few signature generations, the private key could have been computed. This vulnerability affects     Firefox < 80 and Firefox for Android < 80. (CVE-2020-6829)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4076 advisory.

  - nss: Out-of-bounds read when importing curve25519 private key (CVE-2019-11719)

  - nss: PKCS#1 v1.5 signatures can be used for TLS 1.3 (CVE-2019-11727)

  - nss: Use-after-free in sftk_FreeSession due to improper refcounting (CVE-2019-11756)

  - nss: Check length of inputs for cryptographic primitives (CVE-2019-17006)

  - nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state (CVE-2019-17023)

  - nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function     (CVE-2020-12400)

  - nss: ECDSA timing attack mitigation bypass (CVE-2020-12401)

  - nss: Side channel vulnerabilities during RSA key generation (CVE-2020-12402)

  - nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read (CVE-2020-12403)

  - nss: Side channel attack on ECDSA signature generation (CVE-2020-6829)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - nss: Out-of-bounds read when importing curve25519     private key (CVE-2019-11719)

  - nss: Use-after-free in sftk_FreeSession due to improper     refcounting (CVE-2019-11756)

  - nss: Check length of inputs for cryptographic primitives     (CVE-2019-17006)

  - nss: Side channel attack on ECDSA signature generation     (CVE-2020-6829)

  - nss: P-384 and P-521 implementation uses a side-channel     vulnerable modular inversion function (CVE-2020-12400)

  - nss: ECDSA timing attack mitigation bypass     (CVE-2020-12401)

  - nss: Side channel vulnerabilities during RSA key     generation (CVE-2020-12402)

  - nss: CHACHA20-POLY1305 decryption with undersized tag     leads to out-of-bounds read (CVE-2020-12403)

  - nss: PKCS#1 v1.5 signatures can be used for TLS 1.3     (CVE-2019-11727)

  - nss: TLS 1.3 HelloRetryRequest downgrade request sets     client into invalid state (CVE-2019-17023)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4076 advisory.

  - When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger     an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information     disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
    (CVE-2019-11719)

  - A vulnerability exists where it possible to force Network Security Services (NSS) to sign     CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in     CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This     vulnerability affects Firefox < 68. (CVE-2019-11727)

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71. (CVE-2019-11756)

  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72. (CVE-2019-17023)

  - When converting coordinates from projective to affine, the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80     and Firefox for Android < 80. (CVE-2020-12400)

  - During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar     multiplication was removed, resulting in variable-time execution dependent on secret data. This     vulnerability affects Firefox < 80 and Firefox for Android < 80. (CVE-2020-12401)

  - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78. (CVE-2020-12402)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4076 advisory.

  - nss: Out-of-bounds read when importing curve25519 private key (CVE-2019-11719)

  - nss: PKCS#1 v1.5 signatures can be used for TLS 1.3 (CVE-2019-11727)

  - nss: Use-after-free in sftk_FreeSession due to improper refcounting (CVE-2019-11756)

  - nss: Check length of inputs for cryptographic primitives (CVE-2019-17006)

  - nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state (CVE-2019-17023)

  - nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function     (CVE-2020-12400)

  - nss: ECDSA timing attack mitigation bypass (CVE-2020-12401)

  - nss: Side channel vulnerabilities during RSA key generation (CVE-2020-12402)

  - nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read (CVE-2020-12403)

  - nss: Side channel attack on ECDSA signature generation (CVE-2020-6829)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:3280 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3280 advisory.

  - nss: UAF in sftk_FreeSession due to improper refcounting     (CVE-2019-11756)

  - nss: Check length of inputs for cryptographic primitives     (CVE-2019-17006)

  - nss: TLS 1.3 HelloRetryRequest downgrade request sets     client into invalid state (CVE-2019-17023)

  - nss: Side channel vulnerabilities during RSA key     generation (CVE-2020-12402)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3280 advisory.

  - nss: UAF in sftk_FreeSession due to improper refcounting     (CVE-2019-11756)

  - nss: Check length of inputs for cryptographic primitives     (CVE-2019-17006)

  - nss: TLS 1.3 HelloRetryRequest downgrade request sets     client into invalid state (CVE-2019-17023)

  - nss: Side channel vulnerabilities during RSA key     generation (CVE-2020-12402)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in NSS, a set of cryptographic libraries, which may result in side channel/timing attacks or denial of service.

It was discovered that NSS incorrectly handled the TLS State Machine.
A remote attacker could possibly use this issue to cause NSS to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-17023)

Cesar Pereida Garcia discovered that NSS incorrectly handled DSA key generation. A local attacker could possibly use this issue to perform a timing attack and recover DSA keys. (CVE-2020-12399).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass Content Security Policy (CSP) restrictions, conduct cross-site scripting (XSS) attacks, or execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Firefox installed on the remote Windows host is prior to 72.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-01 advisory, including the following:

  - During the initialization of a new content process, a pointer offset can be manipulated leading to     memory corruption and a potentially exploitable crash in the parent process. (CVE-2019-17015)

  - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly     rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in     data exfiltration. (CVE-2019-17016)

  - Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a     crash. We presume that with enough effort that it could be exploited to run arbitrary code.
    (CVE-2019-17017)

  - When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve     the accuracy of the keyboard. (CVE-2019-17018)

  - When Python was installed on Windows, a python file being served with the MIME type of text/plain could     be executed by Python instead of being opened as a text file when the Open option was selected upon     download. (CVE-2019-17019)

  - If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the     Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g.
    includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to     the XML document. (CVE-2019-17020)

  - During the initialization of a new content process, a race condition occurs that can allow a content     process to disclose heap addresses from the parent process. (CVE-2019-17021)

  - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape     < and > characters. Because the resulting string is pasted directly into the text node of the element     this does not result in a direct injection into the webpage; however, if a webpage subsequently copies     the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two     WYSIWYG editors were identified with this behavior, more may exist. (CVE-2019-17022)     
  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3,     resulting in an invalid state transition in the TLS State Machine. If the client gets into this state,     incoming Application Data records will be ignored. (CVE-2019-17023)

  - Mozilla developers Jason Kratzer, Christian Holler, and Bob Clary reported memory safety bugs present in     Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume     that with enough effort some of these could have been exploited to run arbitrary code. (CVE-2019-17024)

  - Mozilla developers Karl Tomlinson, Jason Kratzer, Tyson Smith, Jon Coppeard, and Christian Holler     reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2019-17025)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 72.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-01 advisory, including the following:

- When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly   rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in   data exfiltration. (CVE-2019-17016)

- Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a   crash. We presume that with enough effort that it could be exploited to run arbitrary code.
  (CVE-2019-17017)

- If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the   Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g.
  includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to   the XML document. (CVE-2019-17020)

- When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape   < and > characters. Because the resulting string is pasted directly into the text node of the element   this does not result in a direct injection into the webpage; however, if a webpage subsequently copies   the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two   WYSIWYG editors were identified with this behavior, more may exist. (CVE-2019-17022)   
- After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3,   resulting in an invalid state transition in the TLS State Machine. If the client gets into this state,   incoming Application Data records will be ignored. (CVE-2019-17023)

- Mozilla developers Jason Kratzer, Christian Holler, and Bob Clary reported memory safety bugs present in   Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume   that with enough effort some of these could have been exploited to run arbitrary code. (CVE-2019-17024)

- Mozilla developers Karl Tomlinson, Jason Kratzer, Tyson Smith, Jon Coppeard, and Christian Holler   reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory   corruption and we presume that with enough effort some of these could have been exploited to run   arbitrary code. (CVE-2019-17025)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
147361	NewStart CGSL CORE 5.04 / MAIN 5.04 : nss Multiple Vulnerabilities (NS-SA-2021-0019)	Nessus	NewStart CGSL Local Security Checks	critical
147281	NewStart CGSL MAIN 6.02 : nss Multiple Vulnerabilities (NS-SA-2021-0053)	Nessus	NewStart CGSL Local Security Checks	critical
145878	CentOS 8 : nss and nspr (CESA-2020:3280)	Nessus	CentOS Local Security Checks	critical
142720	Amazon Linux 2 : nspr (ALAS-2020-1559)	Nessus	Amazon Linux Local Security Checks	critical
142600	CentOS 7 : nss and nspr (CESA-2020:4076)	Nessus	CentOS Local Security Checks	critical
141689	Scientific Linux Security Update : nss and nspr on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	critical
141312	Oracle Linux 7 : nss / and / nspr (ELSA-2020-4076)	Nessus	Oracle Linux Local Security Checks	critical
141059	RHEL 7 : nss and nspr (RHSA-2020:4076)	Nessus	Red Hat Local Security Checks	critical
139397	Oracle Linux 8 : nspr / nss (ELSA-2020-3280)	Nessus	Oracle Linux Local Security Checks	medium
139293	RHEL 8 : nss and nspr (RHSA-2020:3280)	Nessus	Red Hat Local Security Checks	critical
138646	Debian DSA-4726-1 : nss - security update	Nessus	Debian Local Security Checks	critical
137555	Ubuntu 16.04 LTS / 18.04 LTS / 19.10 / 20.04 : NSS vulnerabilities (USN-4397-1)	Nessus	Ubuntu Local Security Checks	medium
132854	Ubuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : firefox vulnerabilities (USN-4234-1)	Nessus	Ubuntu Local Security Checks	medium
132709	Mozilla Firefox < 72.0 Multiple Vulnerabilities	Nessus	Windows	medium
132708	Mozilla Firefox < 72.0 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	medium

CVE-2019-17023

MEDIUM

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

medium

medium

medium

medium