A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mozilla
Published: 2019-07-23T13:16:44
Updated: 2020-01-12T00:06:04
Reserved: 2019-05-03T00:00:00
Link: CVE-2019-11727
JSON object: View
NVD Information
Status : Modified
Published: 2019-07-23T14:15:16.450
Modified: 2019-07-30T23:15:12.467
Link: CVE-2019-11727
JSON object: View
Redhat Information
No data.
CWE