After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0015 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-12400:
    When converting coordinates from projective to affine, the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80     and Firefox for Android < 80.

    CVE-2020-12403:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2019-11756:
    Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71.

    CVE-2019-17006:
    In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow.

    CVE-2019-17023:
    After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72.

    CVE-2020-12402:
    During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78.

    CVE-2020-6829:
    When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which     leaked partial information about the nonce used during signature generation. Given an electro-magnetic     trace of a few signature generations, the private key could have been computed. This vulnerability affects     Firefox < 80 and Firefox for Android < 80.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:3280 advisory.

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71. (CVE-2019-11756)

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72. (CVE-2019-17023)

  - NSS has shown timing differences when performing DSA signatures, which was exploitable and could     eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox     ESR < 68.9. (CVE-2020-12399)

  - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78. (CVE-2020-12402)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.15.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.5 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.19.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.1 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.19.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.0.5 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20201105.1021. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20201105.1021 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. (CVE-2020-2574)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. (CVE-2020-2752)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has nss packages installed that are affected by multiple vulnerabilities:

  - When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger     an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information     disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
    (CVE-2019-11719)

  - A vulnerability exists where it possible to force Network Security Services (NSS) to sign     CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in     CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This     vulnerability affects Firefox < 68. (CVE-2019-11727)

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71. (CVE-2019-11756)

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72. (CVE-2019-17023)

  - When converting coordinates from projective to affine, the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80     and Firefox for Android < 80. (CVE-2020-12400)

  - During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar     multiplication was removed, resulting in variable-time execution dependent on secret data. This     vulnerability affects Firefox < 80 and Firefox for Android < 80. (CVE-2020-12401)

  - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78. (CVE-2020-12402)

  - A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using     multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling     multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest     threat from this vulnerability is to confidentiality and system availability. (CVE-2020-12403)

  - When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which     leaked partial information about the nonce used during signature generation. Given an electro-magnetic     trace of a few signature generations, the private key could have been computed. This vulnerability affects     Firefox < 80 and Firefox for Android < 80. (CVE-2020-6829)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nspr installed on the remote host is prior to 4.25.0-2.45. The version of nss-softokn installed on the remote host is prior to 3.53.1-6.46. The version of nss-util installed on the remote host is prior to 3.53.1-1.58. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1522 advisory.

    When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger     an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information     disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
    (CVE-2019-11719)

    A vulnerability exists where it possible to force Network Security Services (NSS) to sign     CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in     CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This     vulnerability affects Firefox < 68. (CVE-2019-11727)

    A use-after-free flaw was found in Mozilla Network Security Services (NSS) related to PK11 session     handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user     running the application compiled with NSS. (CVE-2019-11756)

    A vulnerability was discovered in nss where input text length was not checked when using certain     cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak.
    The highest threat is to confidentiality and integrity of data as well as system availability.
    (CVE-2019-17006)

    A protocol downgrade flaw was found in Network Security Services (NSS). After a HelloRetryRequest has been     sent, the client may negotiate a lower protocol than TLS 1.3, resulting in an invalid state transition in     the TLS State Machine. If the client gets into this state, incoming Application Data records will be     ignored. (CVE-2019-17023)

    A side-channel flaw was found in NSS, in the way P-384 and P-521 curves are used in the generation of EDSA     signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures,     this information can be used to steal the private key. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-12400)

    A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and     non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature     generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures,     this information can be used to steal the private key. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-12401)

    A flaw was found in NSS, where it is vulnerable to RSA key generation cache timing side-channel attacks.
    An attacker with sufficient access to mount cache timing attacks during the RSA key generation process     could recover the private key. The highest threat to this flaw is to confidentiality. (CVE-2020-12402)

    A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it     could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which     was not functioning correctly) and strictly enforcing tag length. The highest threat from this     vulnerability is to confidentiality and system availability. (CVE-2020-12403)

    A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and     non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature     generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures,     this information can be used to steal the private key. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-6829)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has nss packages installed that are affected by multiple vulnerabilities:

  - A vulnerability exists where it possible to force Network Security Services (NSS) to sign     CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in     CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This     vulnerability affects Firefox < 68. (CVE-2019-11727)

  - When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger     an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information     disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
    (CVE-2019-11719)

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71. (CVE-2019-11756)

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72. (CVE-2019-17023)

  - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78. (CVE-2020-12402)

  - When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which     leaked partial information about the nonce used during signature generation. Given an electro-magnetic     trace of a few signature generations, the private key could have been computed. This vulnerability affects     Firefox < 80 and Firefox for Android < 80. (CVE-2020-6829)

  - During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar     multiplication was removed, resulting in variable-time execution dependent on secret data. This     vulnerability affects Firefox < 80 and Firefox for Android < 80. (CVE-2020-12401)

  - When converting coordinates from projective to affine, the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80     and Firefox for Android < 80. (CVE-2020-12400)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has nss packages installed that are affected by multiple vulnerabilities:

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71. (CVE-2019-11756)

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72. (CVE-2019-17023)

  - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78. (CVE-2020-12402)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:3280 advisory.

  - nss: Use-after-free in sftk_FreeSession due to improper refcounting (CVE-2019-11756)

  - nss: Check length of inputs for cryptographic primitives (CVE-2019-17006)

  - nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state (CVE-2019-17023)

  - nss: Side channel vulnerabilities during RSA key generation (CVE-2020-12402)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nspr installed on the remote host is prior to 4.25.0-2. The version of nss installed on the remote host is prior to 3.53.1-3. The version of nss-softokn installed on the remote host is prior to 3.53.1-6. The version of nss- util installed on the remote host is prior to 3.53.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1559 advisory.

    When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger     an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information     disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
    (CVE-2019-11719)

    A vulnerability exists where it possible to force Network Security Services (NSS) to sign     CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in     CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This     vulnerability affects Firefox < 68. (CVE-2019-11727)

    A use-after-free flaw was found in Mozilla Network Security Services (NSS) related to PK11 session     handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user     running the application compiled with NSS. (CVE-2019-11756)

    A vulnerability was discovered in nss where input text length was not checked when using certain     cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak.
    The highest threat is to confidentiality and integrity of data as well as system availability.
    (CVE-2019-17006)

    A protocol downgrade flaw was found in Network Security Services (NSS). After a HelloRetryRequest has been     sent, the client may negotiate a lower protocol than TLS 1.3, resulting in an invalid state transition in     the TLS State Machine. If the client gets into this state, incoming Application Data records will be     ignored. (CVE-2019-17023)

    A side channel flaw was found in nss, in the way P-384 and P-521 curves are used in the generation of EDSA     signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures,     this information can be used to steal the private key. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-12400)

    A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and     non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature     generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures,     this information can be used to steal the private key. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-12401)

    A flaw was found in NSS, where it is vulnerable to RSA key generation cache timing side-channel attacks.
    An attacker with sufficient access to mount cache timing attacks during the RSA key generation process     could recover the private key. The highest threat to this flaw is to confidentiality. (CVE-2020-12402)

    A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it     could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which     was not functioning correctly) and strictly enforcing tag length. The highest threat from this     vulnerability is to confidentiality and system availability. (CVE-2020-12403)

    A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and     non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature     generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures,     this information can be used to steal the private key. The highest threat from this vulnerability is to     data confidentiality. (CVE-2020-6829)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4076 advisory.

  - When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger     an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information     disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
    (CVE-2019-11719)

  - A vulnerability exists where it possible to force Network Security Services (NSS) to sign     CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in     CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This     vulnerability affects Firefox < 68. (CVE-2019-11727)

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71. (CVE-2019-11756)

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72. (CVE-2019-17023)

  - When converting coordinates from projective to affine, the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80     and Firefox for Android < 80. (CVE-2020-12400)

  - During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar     multiplication was removed, resulting in variable-time execution dependent on secret data. This     vulnerability affects Firefox < 80 and Firefox for Android < 80. (CVE-2020-12401)

  - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78. (CVE-2020-12402)

  - A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using     multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling     multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest     threat from this vulnerability is to confidentiality and system availability. (CVE-2020-12403)

  - When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which     leaked partial information about the nonce used during signature generation. Given an electro-magnetic     trace of a few signature generations, the private key could have been computed. This vulnerability affects     Firefox < 80 and Firefox for Android < 80. (CVE-2020-6829)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - nss: Out-of-bounds read when importing curve25519     private key (CVE-2019-11719)

  - nss: Use-after-free in sftk_FreeSession due to improper     refcounting (CVE-2019-11756)

  - nss: Check length of inputs for cryptographic primitives     (CVE-2019-17006)

  - nss: Side channel attack on ECDSA signature generation     (CVE-2020-6829)

  - nss: P-384 and P-521 implementation uses a side-channel     vulnerable modular inversion function (CVE-2020-12400)

  - nss: ECDSA timing attack mitigation bypass     (CVE-2020-12401)

  - nss: Side channel vulnerabilities during RSA key     generation (CVE-2020-12402)

  - nss: CHACHA20-POLY1305 decryption with undersized tag     leads to out-of-bounds read (CVE-2020-12403)

  - nss: PKCS#1 v1.5 signatures can be used for TLS 1.3     (CVE-2019-11727)

  - nss: TLS 1.3 HelloRetryRequest downgrade request sets     client into invalid state (CVE-2019-17023)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4076 advisory.

    - include patches for CVE-2020-6829, CVE-2020-12400,       and CVE-2020-12401 from upstream (ECC constant time issues).
    - include patches for CVE-2020-12403 from upstream       (CHACHA issues).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4076 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

    The following packages have been upgraded to a later upstream version: nss (3.53.1), nss-softokn (3.53.1),     nss-util (3.53.1), nspr (4.25.0). (BZ#1804262, BZ#1804264, BZ#1804271, BZ#1804273)

    Security Fix(es):

    * nss: Out-of-bounds read when importing curve25519 private key (CVE-2019-11719)

    * nss: Use-after-free in sftk_FreeSession due to improper refcounting (CVE-2019-11756)

    * nss: Check length of inputs for cryptographic primitives (CVE-2019-17006)

    * nss: Side channel attack on ECDSA signature generation (CVE-2020-6829)

    * nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function     (CVE-2020-12400)

    * nss: ECDSA timing attack mitigation bypass (CVE-2020-12401)

    * nss: Side channel vulnerabilities during RSA key generation (CVE-2020-12402)

    * nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read (CVE-2020-12403)

    * nss: PKCS#1 v1.5 signatures can be used for TLS 1.3 (CVE-2019-11727)

    * nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state (CVE-2019-17023)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Memory leak: libcurl leaks 120 bytes on each connection (BZ#1688958)

    * NSS does not set downgrade sentinel in ServerHello.random for TLS 1.0 and TLS 1.1 (BZ#1712924)

    * Make TLS 1.3 work in FIPS mode (BZ#1724251)

    * Name Constraints validation: CN treated as DNS name even when syntactically invalid as DNS name     (BZ#1737910)

    * x25519 allowed in FIPS mode (BZ#1754518)

    * When NSS_SDB_USE_CACHE not set, after curl access https, dentry increase but never released - consider     alternative algorithm for benchmarking ACCESS call in sdb_measureAccess (BZ#1779325)

    * Running ipa-backup continuously causes httpd to crash and makes it irrecoverable (BZ#1804015)

    * nss needs to comply to the new SP800-56A rev 3 requirements (BZ#1857308)

    * KDF-self-tests-induced changes for nss in RHEL 7.9 (BZ#1870885)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3280 advisory.

    nspr     [4.25.0-2]
    - Rebuild

    [4.25.0-1]
    - Update to NSPR 4.25

    nss     [3.53.1-11]
    - Fix issue with upgradedb where upgradedb expects standard to       generate dbm databases, not sql databases (default in RHEL8)

    [3.53.1-10]
    - Disable dh timing test because it's unreliable on s390

    [3.53.1-9]
    - Explicitly enable upgradedb/sharedb test cycles

    [3.53.1-8]
    - Disable Delegated Credentials for TLS

    [3.53.1-7]
    - Fix attribute decryption issue where the private key components       integrity check on private attributes where not being checked.

    [3.53.1-6]
    - Update nss-rsa-pkcs1-sigalgs.patch to the upstream version

    [3.53.1-5]
    - Include required checks for dh and ecdh key generation in FIPS mode.

    [3.53.1-4]
    - Add better checks for dh derive operations in FIPS mode.

    [3.53.1-3]
    - Disable NSS_HASH_ALG_SUPPORT as well for MD5 (#1849938)
    - Adjust for update-crypto-policies packaging change (#1848649)
    - Fix compilation with -Werror=strict-prototypes (#1843417)

    [3.53.1-2]
    - Fix regression in MD5 disablement (#1849938)
    - Include rsa_pkcs1_* in signature_algorithms extension (#1847945)

    [3.53.1-1]
    - Update to NSS 3.53.1

    [3.53.0-1]
    - Update to NSS 3.53

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3280 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

    The following packages have been upgraded to a later upstream version: nss (3.53.1), nspr (4.25.0).
    (BZ#1809549, BZ#1809550)

    Security Fix(es):

    * nss: UAF in sftk_FreeSession due to improper refcounting (CVE-2019-11756)

    * nss: Check length of inputs for cryptographic primitives (CVE-2019-17006)

    * nss: Side channel vulnerabilities during RSA key generation (CVE-2020-12402)

    * nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state (CVE-2019-17023)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Install of update of nss.x86_64 adds i686 into transaction (BZ#1663187)

    * NSS does not set downgrade sentinel in ServerHello.random for TLS 1.0 and TLS 1.1 (BZ#1691409)

    * TLS Keying Material Exporter is unsupported by command line tools (BZ#1691454)

    * TLS_AES_256_GCM_SHA384 is not marked as FIPS compatible (BZ#1711375)

    * Make TLS 1.3 work in FIPS mode (BZ#1724250)

    * NSS rejects records with large padding with SHA384 HMAC (BZ#1750921)

    * NSS missing IKEv1 Quick Mode KDF (BZ#1809637)

    * Name Constraints validation: CN treated as DNS name even when syntactically invalid as DNS name     (BZ#1825270)

    * FIPS needs nss to restrict valid dh primes to those primes that are approved. (BZ#1854564)

    * nss needs to comply to the new SP800-56A rev 3 requirements (BZ#1855825)

    Enhancement(s):

    * [RFE] nss should use AES for storage of keys (BZ#1723819)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in NSS, a set of cryptographic libraries, which may result in side channel/timing attacks or denial of service.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4397-1 advisory.

    It was discovered that NSS incorrectly handled the TLS State Machine. A remote attacker could possibly use     this issue to cause NSS to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04     LTS and Ubuntu 19.10. (CVE-2019-17023)

    Cesar Pereida Garcia discovered that NSS incorrectly handled DSA key generation. A local attacker could     possibly use this issue to perform a timing attack and recover DSA keys. (CVE-2020-12399)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4234-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information, bypass Content Security Policy (CSP) restrictions, conduct cross-site scripting     (XSS) attacks, or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 72.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-01 advisory, including the following:

  - During the initialization of a new content process, a pointer offset can be manipulated leading to     memory corruption and a potentially exploitable crash in the parent process. (CVE-2019-17015)

  - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly     rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in     data exfiltration. (CVE-2019-17016)

  - Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a     crash. We presume that with enough effort that it could be exploited to run arbitrary code.
    (CVE-2019-17017)

  - When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve     the accuracy of the keyboard. (CVE-2019-17018)

  - When Python was installed on Windows, a python file being served with the MIME type of text/plain could     be executed by Python instead of being opened as a text file when the Open option was selected upon     download. (CVE-2019-17019)

  - If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the     Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g.
    includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to     the XML document. (CVE-2019-17020)

  - During the initialization of a new content process, a race condition occurs that can allow a content     process to disclose heap addresses from the parent process. (CVE-2019-17021)

  - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape     < and > characters. Because the resulting string is pasted directly into the text node of the element     this does not result in a direct injection into the webpage; however, if a webpage subsequently copies     the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two     WYSIWYG editors were identified with this behavior, more may exist. (CVE-2019-17022)     
  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3,     resulting in an invalid state transition in the TLS State Machine. If the client gets into this state,     incoming Application Data records will be ignored. (CVE-2019-17023)

  - Mozilla developers Jason Kratzer, Christian Holler, and Bob Clary reported memory safety bugs present in     Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume     that with enough effort some of these could have been exploited to run arbitrary code. (CVE-2019-17024)

  - Mozilla developers Karl Tomlinson, Jason Kratzer, Tyson Smith, Jon Coppeard, and Christian Holler     reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2019-17025)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 72.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-01 advisory, including the following:

- When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly   rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in   data exfiltration. (CVE-2019-17016)

- Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a   crash. We presume that with enough effort that it could be exploited to run arbitrary code.
  (CVE-2019-17017)

- If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the   Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g.
  includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to   the XML document. (CVE-2019-17020)

- When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape   < and > characters. Because the resulting string is pasted directly into the text node of the element   this does not result in a direct injection into the webpage; however, if a webpage subsequently copies   the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two   WYSIWYG editors were identified with this behavior, more may exist. (CVE-2019-17022)   
- After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3,   resulting in an invalid state transition in the TLS State Machine. If the client gets into this state,   incoming Application Data records will be ignored. (CVE-2019-17023)

- Mozilla developers Jason Kratzer, Christian Holler, and Bob Clary reported memory safety bugs present in   Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume   that with enough effort some of these could have been exploited to run arbitrary code. (CVE-2019-17024)

- Mozilla developers Karl Tomlinson, Jason Kratzer, Tyson Smith, Jon Coppeard, and Christian Holler   reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory   corruption and we presume that with enough effort some of these could have been exploited to run   arbitrary code. (CVE-2019-17025)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
236475	Alibaba Cloud Linux 3 : 0015: nss (ALINUX3-SA-2021:0015)	Nessus	Alibaba Cloud Linux Local Security Checks	critical
184534	Rocky Linux 8 : nss and nspr (RLSA-2020:3280)	Nessus	Rocky Linux Local Security Checks	critical
164599	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5)	Nessus	Misc.	critical
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	critical
164556	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.0.5)	Nessus	Misc.	critical
164552	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20201105.1021)	Nessus	Misc.	critical
154457	NewStart CGSL CORE 5.05 / MAIN 5.05 : nss Multiple Vulnerabilities (NS-SA-2021-0156)	Nessus	NewStart CGSL Local Security Checks	critical
151520	Amazon Linux AMI : nspr, nss-softokn, nss-util (ALAS-2021-1522)	Nessus	Amazon Linux Local Security Checks	critical
147361	NewStart CGSL CORE 5.04 / MAIN 5.04 : nss Multiple Vulnerabilities (NS-SA-2021-0019)	Nessus	NewStart CGSL Local Security Checks	critical
147281	NewStart CGSL MAIN 6.02 : nss Multiple Vulnerabilities (NS-SA-2021-0053)	Nessus	NewStart CGSL Local Security Checks	critical
145878	CentOS 8 : nss and nspr (CESA-2020:3280)	Nessus	CentOS Local Security Checks	critical
142720	Amazon Linux 2 : nspr, nss-softokn, nss-util, nss (ALAS-2020-1559)	Nessus	Amazon Linux Local Security Checks	critical
142600	CentOS 7 : nss and nspr (RHSA-2020:4076)	Nessus	CentOS Local Security Checks	critical
141689	Scientific Linux Security Update : nss and nspr on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	critical
141312	Oracle Linux 7 : nss / and / nspr (ELSA-2020-4076)	Nessus	Oracle Linux Local Security Checks	critical
141059	RHEL 7 : nss and nspr (RHSA-2020:4076)	Nessus	Red Hat Local Security Checks	critical
139397	Oracle Linux 8 : nss / and / nspr (ELSA-2020-3280)	Nessus	Oracle Linux Local Security Checks	critical
139293	RHEL 8 : nss and nspr (RHSA-2020:3280)	Nessus	Red Hat Local Security Checks	critical
138646	Debian DSA-4726-1 : nss - security update	Nessus	Debian Local Security Checks	critical
137555	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : NSS vulnerabilities (USN-4397-1)	Nessus	Ubuntu Local Security Checks	medium
132854	Ubuntu 16.04 LTS / 18.04 LTS : Firefox vulnerabilities (USN-4234-1)	Nessus	Ubuntu Local Security Checks	high
132709	Mozilla Firefox < 72.0 Multiple Vulnerabilities	Nessus	Windows	high
132708	Mozilla Firefox < 72.0 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2019-17023

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

high

high

high