NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade firefox-esrUpgrade librewolfUpgrade thunderbirdUpgrade firefoxUpgrade mozjs68 | Aug 22, 2024 | Jul 9, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 9, 2020 |
| Centos_linux | — | Upgrade nss-softokn-freebl-debuginfoUpgrade nspr-debuginfoUpgrade nss-debugsourceUpgrade nss-softokn-debuginfoUpgrade nss-util-debuginfoUpgrade nss-tools-debuginfoUpgrade nspr-debugsourceUpgrade nss-sysinit-debuginfoUpgrade nssUpgrade nss-softokn-freebl-develUpgrade nss-develUpgrade nspr-develUpgrade nss-softoknUpgrade nsprUpgrade nss-utilUpgrade nss-sysinitUpgrade nss-softokn-develUpgrade nss-util-develUpgrade nss-debuginfoUpgrade nss-softokn-freeblUpgrade nss-tools | Nov 11, 2021 | Jul 9, 2020 |
| Debian | — | Upgrade firefox-esrUpgrade nssUpgrade thunderbird | Jun 5, 2020 | Jun 5, 2020 |
| Gentoo Linux | — | Upgrade dev-libs/nss. | Jul 28, 2020 | Jul 9, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nss-softokn-develUpgrade nss-softoknUpgrade nss-softokn-freeblUpgrade nss-softokn-freebl-devel | Dec 15, 2020 | Jul 9, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade nss-softoknUpgrade nssUpgrade nss-util | Dec 1, 2020 | Jul 9, 2020 |
| Mfsa2020 20 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 77.0 | Jun 3, 2020 | Jun 2, 2020 |
| Mfsa2020 21 | — | Upgrade to Mozilla Firefox ESR version 68.9Upgrade to the latest version of Mozilla Firefox | Jun 3, 2020 | Jun 2, 2020 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 68.9Upgrade to the latest version of Mozilla Thunderbird | Jun 5, 2020 | Jun 2, 2020 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 68.9.0-11.4.23.0.1.69.3 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 68.9.0-11.4.23.0.1.69.3 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 68.9.0-11.4.23.0.1.69.3 on Solaris 11.4Upgrade mail/thunderbird to version 68.9.0-11.4.23.0.1.69.3 on Solaris 11.4 | Jan 19, 2021 | Jul 9, 2020 |
| Redhat_linux | — | Upgrade nss-debuginfoUpgrade nss-toolsUpgrade nss-util-develUpgrade nsprUpgrade nss-util-debuginfoUpgrade nspr-develUpgrade nssUpgrade nss-softokn-freebl-debuginfoNo solution existsUpgrade nss-softokn-develUpgrade nss-softoknUpgrade nss-softokn-freeblUpgrade nss-utilUpgrade nss-tools-debuginfoUpgrade nss-sysinitUpgrade nss-debugsourceUpgrade nss-sysinit-debuginfoUpgrade nspr-debugsourceUpgrade nss-develUpgrade nss-softokn-freebl-develUpgrade nss-softokn-debuginfoUpgrade nspr-debuginfo | Nov 11, 2021 | Jul 9, 2020 |
| Rocky_linux | — | Upgrade nspr-debuginfoUpgrade nspr-debugsourceUpgrade nsprUpgrade nspr-devel | Mar 12, 2024 | Jul 9, 2020 |
| Suse | — | Upgrade libfreebl3Upgrade mozilla-nss-certsUpgrade mozilla-nssUpgrade mozilla-nss-sysinit-32bitUpgrade libfreebl3-32bitUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nspr-develUpgrade mozilla-nspr-32bitUpgrade mozilla-nsprUpgrade mozilla-nss-sysinitUpgrade libfreebl3-hmacUpgrade libsoftokn3Upgrade libsoftokn3-hmac-32bitUpgrade mozilla-nss-32bitUpgrade mozilla-nss-toolsUpgrade libsoftokn3-hmacUpgrade mozilla-nss-develUpgrade libfreebl3-hmac-32bitUpgrade libsoftokn3-32bit | Jun 19, 2020 | Jun 4, 2020 |
| Ubuntu | — | Upgrade libnss3Upgrade thunderbirdUpgrade firefoxUpgrade libnss3 (Ubuntu Pro) | Jun 5, 2020 | Jun 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub