critical
CVE-2019-17006
nss: Check length of inputs for cryptographic primitives
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by Red Hat (medium), Amazon (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (medium).
Description
In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 3.0 | nss | 3.44-8.ph3 |
| amazon linux 1 | nspr, nspr-debuginfo, nspr-devel and 8 more | 4.25.0-2.45.amzn1 and 2 more |
| amazon linux 2 | nspr, nspr-debuginfo, nspr-devel and 14 more | 4.25.0-2.amzn2 and 3 more |
| debian 10 | nss | 2:3.42.1-1+deb10u3 |
| debian 11 | nss | 2:3.47-1 |
| debian 12 | nss | 2:3.47-1 |
| debian 13 | nss | 2:3.47-1 |
| debian 14 | nss | 2:3.47-1 |
| debian 8 | nss | 2:3.26-1+debu8u10 |
| debian 9 | nss | 2:3.26.2-1.1+deb9u2 |
| echo | nss | 2:3.47-1 |
| Oracle Linux 7 | nspr, nspr-devel, nss and 10 more | 4.25.0-2.el7_9 and 3 more |
Show all 81 entries from 26 sources
| Source | Package | Fixed in |
|---|---|---|
| Photon OS 3.0 | nss | 3.44-8.ph3 |
| amazon linux 1 | nspr | 4.25.0-2.45.amzn1 |
| amazon linux 1 | nspr-debuginfo | 4.25.0-2.45.amzn1 |
| amazon linux 1 | nspr-devel | 4.25.0-2.45.amzn1 |
| amazon linux 1 | nss-softokn | 3.53.1-6.46.amzn1 |
| amazon linux 1 | nss-softokn-debuginfo | 3.53.1-6.46.amzn1 |
| amazon linux 1 | nss-softokn-devel | 3.53.1-6.46.amzn1 |
| amazon linux 1 | nss-softokn-freebl | 3.53.1-6.46.amzn1 |
| amazon linux 1 | nss-softokn-freebl-devel | 3.53.1-6.46.amzn1 |
| amazon linux 1 | nss-util | 3.53.1-1.58.amzn1 |
| amazon linux 1 | nss-util-debuginfo | 3.53.1-1.58.amzn1 |
| amazon linux 1 | nss-util-devel | 3.53.1-1.58.amzn1 |
| amazon linux 2 | nspr | 4.25.0-2.amzn2 |
| amazon linux 2 | nspr-debuginfo | 4.25.0-2.amzn2 |
| amazon linux 2 | nspr-devel | 4.25.0-2.amzn2 |
| amazon linux 2 | nss | 3.53.1-3.amzn2 |
| amazon linux 2 | nss-debuginfo | 3.53.1-3.amzn2 |
| amazon linux 2 | nss-devel | 3.53.1-3.amzn2 |
| amazon linux 2 | nss-pkcs11-devel | 3.53.1-3.amzn2 |
| amazon linux 2 | nss-softokn | 3.53.1-6.amzn2 |
| amazon linux 2 | nss-softokn-debuginfo | 3.53.1-6.amzn2 |
| amazon linux 2 | nss-softokn-devel | 3.53.1-6.amzn2 |
| amazon linux 2 | nss-softokn-freebl | 3.53.1-6.amzn2 |
| amazon linux 2 | nss-softokn-freebl-devel | 3.53.1-6.amzn2 |
| amazon linux 2 | nss-sysinit | 3.53.1-3.amzn2 |
| amazon linux 2 | nss-tools | 3.53.1-3.amzn2 |
| amazon linux 2 | nss-util | 3.53.1-1.amzn2 |
| amazon linux 2 | nss-util-debuginfo | 3.53.1-1.amzn2 |
| amazon linux 2 | nss-util-devel | 3.53.1-1.amzn2 |
| debian 10 | nss | 2:3.42.1-1+deb10u3 |
| debian 11 | nss | 2:3.47-1 |
| debian 12 | nss | 2:3.47-1 |
| debian 13 | nss | 2:3.47-1 |
| debian 14 | nss | 2:3.47-1 |
| debian 8 | nss | 2:3.26-1+debu8u10 |
| debian 9 | nss | 2:3.26.2-1.1+deb9u2 |
| echo | nss | 2:3.47-1 |
| Oracle Linux 7 | nspr | 4.25.0-2.el7_9 |
| Oracle Linux 7 | nspr-devel | 4.25.0-2.el7_9 |
| Oracle Linux 7 | nss | 3.53.1-3.el7_9 |
| Oracle Linux 7 | nss-devel | 3.53.1-3.el7_9 |
| Oracle Linux 7 | nss-pkcs11-devel | 3.53.1-3.el7_9 |
| Oracle Linux 7 | nss-softokn | 3.53.1-6.0.1.el7_9 |
| Oracle Linux 7 | nss-softokn-devel | 3.53.1-6.0.1.el7_9 |
| Oracle Linux 7 | nss-softokn-freebl | 3.53.1-6.0.1.el7_9 |
| Oracle Linux 7 | nss-softokn-freebl-devel | 3.53.1-6.0.1.el7_9 |
| Oracle Linux 7 | nss-sysinit | 3.53.1-3.el7_9 |
| Oracle Linux 7 | nss-tools | 3.53.1-3.el7_9 |
| Oracle Linux 7 | nss-util | 3.53.1-1.el7_9 |
| Oracle Linux 7 | nss-util-devel | 3.53.1-1.el7_9 |
| Oracle Linux 8 | nspr | 4.25.0-2.el8_2 |
| Oracle Linux 8 | nspr-devel | 4.25.0-2.el8_2 |
| Oracle Linux 8 | nss | 3.53.1-11.el8_2 |
| Oracle Linux 8 | nss-devel | 3.53.1-11.el8_2 |
| Oracle Linux 8 | nss-softokn | 3.53.1-11.el8_2 |
| Oracle Linux 8 | nss-softokn-devel | 3.53.1-11.el8_2 |
| Oracle Linux 8 | nss-softokn-freebl | 3.53.1-11.el8_2 |
| Oracle Linux 8 | nss-softokn-freebl-devel | 3.53.1-11.el8_2 |
| Oracle Linux 8 | nss-sysinit | 3.53.1-11.el8_2 |
| Oracle Linux 8 | nss-tools | 3.53.1-11.el8_2 |
| Oracle Linux 8 | nss-util | 3.53.1-11.el8_2 |
| Oracle Linux 8 | nss-util-devel | 3.53.1-11.el8_2 |
| Red Hat | nss | no fix listed |
| Red Hat | nss-devel | no fix listed |
| Red Hat | nss-pkcs11-devel | no fix listed |
| Red Hat | nss-sysinit | no fix listed |
| Red Hat | nss-tools | no fix listed |
| rocky 8 | nspr | 4.25.0-2.el8_2 |
| rocky 8 | nspr-devel | 4.25.0-2.el8_2 |
| root.io debian 11 | rootio-nss | 2:3.47-1 |
| root.io debian 12 | rootio-nss | 2:3.47-1 |
| root.io debian 13 | rootio-nss | 2:3.47-1 |
| seal Red Hat 7 | nss | 3.53.1-3.el7_9+sp999 |
| seal Red Hat 7 | seal-nss | 3.53.1-3.el7_9+sp999 |
| ubuntu 14.04-ESM | nss | 2:3.28.4-0ubuntu0.14.04.5+esm4 |
| ubuntu 16.04 | nss | 2:3.28.4-0ubuntu0.16.04.10 |
| ubuntu 16.04-ESM | nss | 2:3.28.4-0ubuntu0.16.04.10 |
| ubuntu 18.04 | nss | 2:3.35-2ubuntu2.7 |
| ubuntu 18.04-ESM | nss | 2:3.35-2ubuntu2.7 |
| ubuntu 19.04 | nss | 2:3.42-1ubuntu2.5 |
| ubuntu 19.10 | nss | 2:3.45-1ubuntu2.2 |
References
- https://access.redhat.com/errata/RHSA-2020:3280
- https://access.redhat.com/security/cve/CVE-2019-17006
- https://bugzilla.mozilla.org/show_bug.cgi?id=1539788
- https://bugzilla.redhat.com/show_bug.cgi?id=1663187
- https://bugzilla.redhat.com/show_bug.cgi?id=1691454
- https://bugzilla.redhat.com/show_bug.cgi?id=1711375
- https://bugzilla.redhat.com/show_bug.cgi?id=1724250
- https://bugzilla.redhat.com/show_bug.cgi?id=1750921
All 33 references
- https://bugzilla.redhat.com/show_bug.cgi?id=1774835
- https://bugzilla.redhat.com/show_bug.cgi?id=1775916
- https://bugzilla.redhat.com/show_bug.cgi?id=1791225
- https://bugzilla.redhat.com/show_bug.cgi?id=1809637
- https://bugzilla.redhat.com/show_bug.cgi?id=1825270
- https://bugzilla.redhat.com/show_bug.cgi?id=1826231
- https://bugzilla.redhat.com/show_bug.cgi?id=1854564
- https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11756
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17006
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17023
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12402
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes
- https://errata.rockylinux.org/RLSA-2020:3280
- https://hg.mozilla.org/projects/nss/rev/9d1f5e71773d4e3146524096d74cb96c8df51abe
- https://hg.mozilla.org/projects/nss/rev/dfd6996fe7425eb0437346d11a01082f16fcfe34
- https://linux.oracle.com/cve/CVE-2019-17006.html
- https://linux.oracle.com/errata/ELSA-2020-4076.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-17006
- https://security.netapp.com/advisory/ntap-20210129-0001/
- https://ubuntu.com/security/notices/USN-4231-1
- https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04
- https://www.cve.org/CVERecord?id=CVE-2019-17006