CVE-2020-12399

Description

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.

Risk Information

Base Score
4.4
MODERATE
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.101

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2020-12399,CVE-2020-12405 are fixed in Mozilla Firefox ESR (68.9.0)Windows
Vulnerabilities CVE-2020-12399,CVE-2020-12405 are fixed in Mozilla Firefox ESR (x64) (68.9.0)Windows
Multiple vulnerabilities fixed in Mozilla Firefox (77.0)Windows
Multiple vulnerabilities fixed in Mozilla Firefox (x64) (77.0)Windows
Vulnerabilities CVE-2020-12399,CVE-2020-12405,CVE-2020-12406,CVE-2020-12410,CVE-2020-12398 are fixed in Mozilla Thunderbird (68.9.0)Windows
Vulnerabilities CVE-2020-12399,CVE-2020-12405,CVE-2020-12406,CVE-2020-12410,CVE-2020-12398 are fixed in Mozilla Thunderbird (x64) (68.9.0)Windows
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (77.0.1)Mac
Vulnerabilities CVE-2020-12399,CVE-2020-12405,CVE-2020-12406,CVE-2020-12410,CVE-2020-12398 are fixed in Mozilla Thunderbird For Mac (68.9.0)Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 68.0.1Mac
Multiple Vulnerabilities are affected in Firefox ESR for Mac 68.0.1Mac
Vulnerabilities CVE-2020-12398,CVE-2020-12399,CVE-2020-12405,CVE-2020-12406 are affected in Mozilla Thunderbird for Mac 68.8.0Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 76.0.1Mac
Vulnerabilities CVE-2020-12399,CVE-2020-12405 are fixed in Mozilla Firefox For Mac 68.9Mac
firefox-esr security update(DSA-4695-1) firefox-esr_68.9.0esr-1~deb9u1_i386.debLinux
firefox-esr security update(DSA-4695-1) firefox-esr_68.9.0esr-1~deb9u1_amd64.debLinux
firefox-esr security update(DSA-4695-1) firefox-esr_68.9.0esr-1~deb10u1_i386.debLinux
firefox-esr security update(DSA-4695-1) firefox-esr_68.9.0esr-1~deb10u1_amd64.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.16.04.1_i386.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.16.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.18.04.1_i386.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.18.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.19.10.1_i386.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.19.10.1_amd64.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.20.04.1_amd64.debLinux
thunderbird security update(DSA-4702-1) thunderbird_68.9.0-1~deb9u1_i386.debLinux
thunderbird security update(DSA-4702-1) thunderbird_68.9.0-1~deb9u1_amd64.debLinux
thunderbird security update(DSA-4702-1) thunderbird_68.9.0-1~deb10u1_i386.debLinux
thunderbird security update(DSA-4702-1) thunderbird_68.9.0-1~deb10u1_amd64.debLinux
Network Security Service library (USN-4397-1) libnss3_3.35-2ubuntu2.8_i386.debLinux
Network Security Service library (USN-4397-1) libnss3_3.35-2ubuntu2.8_amd64.debLinux
Network Security Service library (USN-4397-1) libnss3_3.45-1ubuntu2.3_i386.debLinux
Network Security Service library (USN-4397-1) libnss3_3.45-1ubuntu2.3_amd64.debLinux
Network Security Service library (USN-4397-1) libnss3_3.49.1-1ubuntu1.1_i386.debLinux
Network Security Service library (USN-4397-1) libnss3_3.49.1-1ubuntu1.1_amd64.debLinux
Network Security Service library (USN-4397-1) libnss3_3.28.4-0ubuntu0.16.04.11_i386.debLinux
Network Security Service library (USN-4397-1) libnss3_3.28.4-0ubuntu0.16.04.11_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.16.04.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.16.04.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.18.04.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.18.04.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.19.10.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.19.10.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.20.04.1_amd64.debLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) libfreebl3-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) libfreebl3-32bit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) libfreebl3-debuginfo-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) libfreebl3-debuginfo-32bit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) libfreebl3-hmac-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) libfreebl3-hmac-32bit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) libsoftokn3-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) libsoftokn3-32bit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) libsoftokn3-debuginfo-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) libsoftokn3-debuginfo-32bit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) libsoftokn3-hmac-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) libsoftokn3-hmac-32bit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nspr-4.25-19.15.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nspr-32bit-4.25-19.15.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nspr-debuginfo-4.25-19.15.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nspr-debuginfo-32bit-4.25-19.15.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nspr-debugsource-4.25-19.15.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nspr-devel-4.25-19.15.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-32bit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-certs-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-certs-32bit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-certs-debuginfo-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-certs-debuginfo-32bit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-debuginfo-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-debuginfo-32bit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-debugsource-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-devel-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-sysinit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-sysinit-32bit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-sysinit-debuginfo-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-sysinit-debuginfo-32bit-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-tools-3.53.1-58.48.1.x86_64.rpmLinux
SUSE-SU-2020:1839-1(SUSE Linux Enterprise Server 12-SP5 ) mozilla-nss-tools-debuginfo-3.53.1-58.48.1.x86_64.rpmLinux

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-314497Mozilla Firefox ESR (68.9.0)
PATCH-314498Mozilla Firefox ESR (x64) (68.9.0)
PATCH-314495Mozilla Firefox (77.0)
PATCH-314496Mozilla Firefox (x64) (77.0)
PATCH-314521Mozilla Thunderbird (68.9.0)
PATCH-314522Mozilla Thunderbird (x64) (68.9.0)
PATCH-607000Mozilla Firefox For Mac (124.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611808Mozilla Firefox ESR for MAC 128.14.0
PATCH-611807Mozilla Thunderbird For Mac (142.0)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-612783Mozilla Firefox For Mac (145.0.1)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234