Lucene search

[email protected]CVE-2021-43527

HistoryDec 08, 2021 - 10:15 p.m.

CVE-2021-43527

2021-12-0822:15:09

CWE-787

[email protected]

web.nvd.nist.gov

536

cve-2021-43527

network security services

nss

heap overflow

der-encoded

dsa

rsa-pss

signatures

vulnerability

security

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

77.3%

JSON

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

Affected configurations

Vulners

NVD

Node

mozillanssRange≤3.73

mozillanssRange≤3.68.1

VendorProductVersionCPE
mozillanss*cpe:2.3:a:mozilla:nss:*:*:*:*:*:*:*:*
mozillanss*cpe:2.3:a:mozilla:nss:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	nss	*	cpe:2.3:a:mozilla:nss::::::::
mozilla	nss	*	cpe:2.3:a:mozilla:nss::::::::

CNA Affected

[
  {
    "vendor": "Mozilla",
    "product": "NSS",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "3.73",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "3.68.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]