critical
CVE-2021-43527
nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Red Hat, AlmaLinux, Amazon, CBL-Mariner, Oracle, Photon OS. Rated lower by Ubuntu (high).
Description
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | nss, nss-devel, nss-softokn and 7 more | 3.67.0-7.el8_5 |
| amazon linux 1 | nss, nss-debuginfo, nss-devel and 3 more | 3.53.1-7.87.amzn1 |
| amazon linux 2 | nspr, nspr-debuginfo, nspr-devel and 14 more | 4.32.0-1.amzn2 and 3 more |
| amazon linux 2022 | nspr, nspr-debuginfo, nspr-devel and 18 more | 4.35.0-1.amzn2022.0.1 and 1 more |
| amazon linux 2023 | nspr, nspr-debuginfo, nspr-devel and 18 more | 4.35.0-1.amzn2023.0.2 and 1 more |
| CBL-Mariner 1.0 | nss | 0:3.73-1.cm1 |
| CBL-Mariner 2.0 | nss | 0:3.75-1.cm2 |
| Oracle Linux 6 | nss, nss-devel, nss-pkcs11-devel and 2 more | 3.44.0-7.0.2.el6_10 |
| Oracle Linux 7 | nss, nss-devel, nss-pkcs11-devel and 2 more | 3.67.0-4.el7_9 |
| Oracle Linux 8 | nss, nss-devel, nss-softokn and 7 more | 3.67.0-7.el8_5 |
| Photon OS 1.0 | nss | 3.44-5.ph1 |
| Photon OS 2.0 | nss | 3.44-6.ph2 |
Show all 155 entries from 50 sources
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | nss | 3.67.0-7.el8_5 |
| alma 8 | nss-devel | 3.67.0-7.el8_5 |
| alma 8 | nss-softokn | 3.67.0-7.el8_5 |
| alma 8 | nss-softokn-devel | 3.67.0-7.el8_5 |
| alma 8 | nss-softokn-freebl | 3.67.0-7.el8_5 |
| alma 8 | nss-softokn-freebl-devel | 3.67.0-7.el8_5 |
| alma 8 | nss-sysinit | 3.67.0-7.el8_5 |
| alma 8 | nss-tools | 3.67.0-7.el8_5 |
| alma 8 | nss-util | 3.67.0-7.el8_5 |
| alma 8 | nss-util-devel | 3.67.0-7.el8_5 |
| amazon linux 1 | nss | 3.53.1-7.87.amzn1 |
| amazon linux 1 | nss-debuginfo | 3.53.1-7.87.amzn1 |
| amazon linux 1 | nss-devel | 3.53.1-7.87.amzn1 |
| amazon linux 1 | nss-pkcs11-devel | 3.53.1-7.87.amzn1 |
| amazon linux 1 | nss-sysinit | 3.53.1-7.87.amzn1 |
| amazon linux 1 | nss-tools | 3.53.1-7.87.amzn1 |
| amazon linux 2 | nspr | 4.32.0-1.amzn2 |
| amazon linux 2 | nspr-debuginfo | 4.32.0-1.amzn2 |
| amazon linux 2 | nspr-devel | 4.32.0-1.amzn2 |
| amazon linux 2 | nss | 3.67.0-4.amzn2.0.1 |
| amazon linux 2 | nss-debuginfo | 3.67.0-4.amzn2.0.1 |
| amazon linux 2 | nss-devel | 3.67.0-4.amzn2.0.1 |
| amazon linux 2 | nss-pkcs11-devel | 3.67.0-4.amzn2.0.1 |
| amazon linux 2 | nss-softokn | 3.67.0-3.amzn2 |
| amazon linux 2 | nss-softokn-debuginfo | 3.67.0-3.amzn2 |
| amazon linux 2 | nss-softokn-devel | 3.67.0-3.amzn2 |
| amazon linux 2 | nss-softokn-freebl | 3.67.0-3.amzn2 |
| amazon linux 2 | nss-softokn-freebl-devel | 3.67.0-3.amzn2 |
| amazon linux 2 | nss-sysinit | 3.67.0-4.amzn2.0.1 |
| amazon linux 2 | nss-tools | 3.67.0-4.amzn2.0.1 |
| amazon linux 2 | nss-util | 3.67.0-1.amzn2 |
| amazon linux 2 | nss-util-debuginfo | 3.67.0-1.amzn2 |
| amazon linux 2 | nss-util-devel | 3.67.0-1.amzn2 |
| amazon linux 2022 | nspr | 4.35.0-1.amzn2022.0.1 |
| amazon linux 2022 | nspr-debuginfo | 4.35.0-1.amzn2022.0.1 |
| amazon linux 2022 | nspr-devel | 4.35.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-debuginfo | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-debugsource | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-devel | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-pkcs11-devel | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-softokn | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-softokn-debuginfo | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-softokn-devel | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-softokn-freebl | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-softokn-freebl-debuginfo | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-softokn-freebl-devel | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-sysinit | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-sysinit-debuginfo | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-tools | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-tools-debuginfo | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-util | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-util-debuginfo | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2022 | nss-util-devel | 3.83.0-1.amzn2022.0.1 |
| amazon linux 2023 | nspr | 4.35.0-1.amzn2023.0.2 |
| amazon linux 2023 | nspr-debuginfo | 4.35.0-1.amzn2023.0.2 |
| amazon linux 2023 | nspr-devel | 4.35.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-debuginfo | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-debugsource | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-devel | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-pkcs11-devel | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-softokn | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-softokn-debuginfo | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-softokn-devel | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-softokn-freebl | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-softokn-freebl-debuginfo | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-softokn-freebl-devel | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-sysinit | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-sysinit-debuginfo | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-tools | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-tools-debuginfo | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-util | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-util-debuginfo | 3.83.0-1.amzn2023.0.2 |
| amazon linux 2023 | nss-util-devel | 3.83.0-1.amzn2023.0.2 |
| CBL-Mariner 1.0 | nss | 0:3.73-1.cm1 |
| CBL-Mariner 2.0 | nss | 0:3.75-1.cm2 |
| Oracle Linux 6 | nss | 3.44.0-7.0.2.el6_10 |
| Oracle Linux 6 | nss-devel | 3.44.0-7.0.2.el6_10 |
| Oracle Linux 6 | nss-pkcs11-devel | 3.44.0-7.0.2.el6_10 |
| Oracle Linux 6 | nss-sysinit | 3.44.0-7.0.2.el6_10 |
| Oracle Linux 6 | nss-tools | 3.44.0-7.0.2.el6_10 |
| Oracle Linux 7 | nss | 3.67.0-4.el7_9 |
| Oracle Linux 7 | nss-devel | 3.67.0-4.el7_9 |
| Oracle Linux 7 | nss-pkcs11-devel | 3.67.0-4.el7_9 |
| Oracle Linux 7 | nss-sysinit | 3.67.0-4.el7_9 |
| Oracle Linux 7 | nss-tools | 3.67.0-4.el7_9 |
| Oracle Linux 8 | nss | 3.67.0-7.el8_5 |
| Oracle Linux 8 | nss-devel | 3.67.0-7.el8_5 |
| Oracle Linux 8 | nss-softokn | 3.67.0-7.el8_5 |
| Oracle Linux 8 | nss-softokn-devel | 3.67.0-7.el8_5 |
| Oracle Linux 8 | nss-softokn-freebl | 3.67.0-7.el8_5 |
| Oracle Linux 8 | nss-softokn-freebl-devel | 3.67.0-7.el8_5 |
| Oracle Linux 8 | nss-sysinit | 3.67.0-7.el8_5 |
| Oracle Linux 8 | nss-tools | 3.67.0-7.el8_5 |
| Oracle Linux 8 | nss-util | 3.67.0-7.el8_5 |
| Oracle Linux 8 | nss-util-devel | 3.67.0-7.el8_5 |
| Photon OS 1.0 | nss | 3.44-5.ph1 |
| Photon OS 2.0 | nss | 3.44-6.ph2 |
| Photon OS 3.0 | nss | 3.44-7.ph3 |
| Photon OS 4.0 | nss | 3.66-2.ph4 |
| Photon OS 4.0 | nss-devel | 3.66-2.ph4 |
| Photon OS 4.0 | nss-libs | 3.66-2.ph4 |
| alpine 3.12 | nss | 3.60-r2 |
| alpine 3.13 | nss | 3.66-r0 |
| alpine 3.14 | nss | 3.66-r0 |
| alpine 3.15 | nss | 3.72-r1 |
| alpine 3.16 | nss | 3.73-r0 |
| alpine 3.17 | nss | 3.73-r0 |
| alpine 3.18 | nss | 3.73-r0 |
| alpine 3.19 | nss | 3.73-r0 |
| alpine 3.20 | nss | 3.73-r0 |
| alpine 3.21 | nss | 3.73-r0 |
| alpine 3.22 | nss | 3.73-r0 |
| alpine 3.23 | nss | 3.73-r0 |
| alpine 3.24 | nss | 3.73-r0 |
| alpine edge | nss | 3.73-r0 |
| debian 10 | nss | 2:3.42.1-1+deb10u4 |
| debian 11 | nss | 2:3.61-1+deb11u1 |
| debian 12 | nss | 2:3.73-1 |
| debian 13 | nss | 2:3.73-1 |
| debian 14 | nss | 2:3.73-1 |
| debian 9 | nss | 2:3.26.2-1.1+deb9u3 |
| echo | nss | 2:3.73-1 |
| rocky 8 | nss | 3.67.0-7.el8_5 |
| rocky 8 | nss-devel | 3.67.0-7.el8_5 |
| rocky 8 | nss-softokn | 3.67.0-7.el8_5 |
| rocky 8 | nss-softokn-devel | 3.67.0-7.el8_5 |
| rocky 8 | nss-softokn-freebl | 3.67.0-7.el8_5 |
| rocky 8 | nss-softokn-freebl-devel | 3.67.0-7.el8_5 |
| rocky 8 | nss-sysinit | 3.67.0-7.el8_5 |
| rocky 8 | nss-tools | 3.67.0-7.el8_5 |
| rocky 8 | nss-util | 3.67.0-7.el8_5 |
| rocky 8 | nss-util-devel | 3.67.0-7.el8_5 |
| root.io debian 11 | rootio-nss | 2:3.61-1+deb11u1 |
| root.io debian 12 | rootio-nss | 2:3.73-1 |
| root.io debian 13 | rootio-nss | 2:3.73-1 |
| ubuntu 14.04-ESM | nss | 2:3.28.4-0ubuntu0.14.04.5+esm10 |
| ubuntu 16.04-ESM | nss | 2:3.28.4-0ubuntu0.16.04.14+esm2 |
| ubuntu 18.04 | nss | 2:3.35-2ubuntu2.13 |
| ubuntu 18.04 | thunderbird | 1:78.14.0+build1-0ubuntu0.18.04.2 |
| ubuntu 18.04-ESM | nss | 2:3.35-2ubuntu2.13 |
| ubuntu 20.04 | nss | 2:3.49.1-1ubuntu1.6 |
| ubuntu 20.04 | thunderbird | 1:78.14.0+build1-0ubuntu0.20.04.2 |
| ubuntu 20.04-ESM | nss | 2:3.49.1-1ubuntu1.6 |
| ubuntu 21.04 | nss | 2:3.61-1ubuntu2.1 |
| ubuntu 21.04 | thunderbird | 1:78.14.0+build1-0ubuntu0.21.04.2 |
| ubuntu 21.10 | nss | 2:3.68-1ubuntu1.1 |
| ubuntu 21.10 | thunderbird | 1:91.3.1+build1-0ubuntu0.21.10.2 |
| ubuntu 22.04 | nss | 2:3.68-1ubuntu2 |
| ubuntu 22.04 | thunderbird | 1:91.4.0+build1.1-0ubuntu1 |
| ubuntu 22.10 | nss | 2:3.68-1ubuntu2 |
| ubuntu 22.10 | thunderbird | 1:91.4.0+build1.1-0ubuntu1 |
| ubuntu 23.04 | nss | 2:3.68-1ubuntu2 |
| ubuntu 23.04 | thunderbird | 1:91.4.0+build1.1-0ubuntu1 |
References
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-43527.json
- https://access.redhat.com/security/cve/CVE-2021-43527
- https://bugzilla.mozilla.org/show_bug.cgi?id=1737470
- https://cert-portal.siemens.com/productcert/pdf/ssa-594438.pdf
- https://errata.almalinux.org/8/ALSA-2021-4903.html
- https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_68_1_RTM/
- https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_73_RTM/
- https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html
All 22 references
- https://linux.oracle.com/cve/CVE-2021-43527.html
- https://linux.oracle.com/errata/ELSA-2021-9591.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-43527
- https://security.gentoo.org/glsa/202212-05
- https://security.netapp.com/advisory/ntap-20211229-0002/
- https://ubuntu.com/security/notices/USN-5168-1
- https://ubuntu.com/security/notices/USN-5168-2
- https://ubuntu.com/security/notices/USN-5168-3
- https://ubuntu.com/security/notices/USN-5168-4
- https://www.cve.org/CVERecord?id=CVE-2021-43527
- https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/
- https://www.mozilla.org/security/advisories/mfsa2021-51/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.starwindsoftware.com/security/sw-20220802-0001/