Bug 1728436 (CVE-2019-11719)

Summary: CVE-2019-11719 nss: Out-of-bounds read when importing curve25519 private key
Product: [Other] Security Response Reporter: Doran Moppert <dmoppert>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ahardin, asoldano, bbaranow, bleanhar, bmaxwell, brian.stansberry, ccoleman, cdewolf, chazlett, crypto-team, darran.lofthouse, dedgar, dosoudil, dueno, elio.maldonado.batiz, eparis, iweiss, jawilson, jgoulding, jhorak, jokerman, jperkins, kdudka, kengert, krathod, kwills, lgao, mchappel, msochure, msvehla, nss-nspr-maint, nwallace, pmackay, psotirop, rguimara, rsvoboda, smaestri, stransky, tom.jenkinson, twalsh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: nss 3.36.8, nss 3.44.1, nss-3.47 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-31 01:18:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1733035, 1733036, 1770065    
Bug Blocks: 1729336    

Description Doran Moppert 2019-07-10 00:27:29 UTC
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure.



External Reference:

https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719

Comment 1 Doran Moppert 2019-07-10 00:27:32 UTC
Acknowledgments:

Name: the Mozilla project
Upstream: Henry Corrigan-Gibbs

Comment 5 Doran Moppert 2019-07-12 01:26:00 UTC
Statement:

Firefox on Red Hat Enterprise Linux is built against the system nss library.

Comment 7 errata-xmlrpc 2019-07-30 19:49:53 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1951 https://access.redhat.com/errata/RHSA-2019:1951

Comment 8 Product Security DevOps Team 2019-07-31 01:18:23 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11719

Comment 9 Joshua Padman 2019-07-31 05:13:11 UTC
This vulnerability is out of security support scope for the following product:
 * Red Hat Enterprise Application Platform 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 10 Mark Cooper 2019-10-04 02:45:59 UTC
The library nss-altfiles does not share any import and/or certificate code with nss. 
 * nss-altfiles only reads information from files in same format as /etc/passwd and /etc/group