Bug 1728437 (CVE-2019-11729)

Summary:	CVE-2019-11729 nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault
Product:	[Other] Security Response	Reporter:	Doran Moppert <dmoppert>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahardin, asoldano, bbaranow, bleanhar, bmaxwell, bmontgom, brian.stansberry, ccoleman, cdewolf, chazlett, crypto-team, darran.lofthouse, dedgar, dosoudil, dueno, elio.maldonado.batiz, eparis, iweiss, jawilson, jburrell, jgoulding, jhorak, jokerman, jperkins, kdudka, kengert, krathod, kwills, lgao, mchappel, msochure, msvehla, nss-nspr-maint, nstielau, nwallace, pmackay, psotirop, rguimara, rsvoboda, smaestri, sponnaga, stransky, tom.jenkinson, twalsh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nss 3.45	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-07-31 01:18:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1733035, 1733036, 1777712, 1780774, 1780775, 1781167, 1781196, 1781197, 1804354, 1804355, 1804356, 1862437, 1862438, 1862439
Bug Blocks:	1729336

Description Doran Moppert 2019-07-10 00:27:35 UTC

Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used.



External Reference:

https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729

Comment 1 Doran Moppert 2019-07-10 00:27:38 UTC

Acknowledgments:

Name: the Mozilla project
Upstream: Jonas Allmann

Comment 5 Doran Moppert 2019-07-12 01:27:50 UTC

Statement:

Firefox on Red Hat Enterprise Linux is built against the system nss library.

Comment 7 errata-xmlrpc 2019-07-30 19:49:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1951 https://access.redhat.com/errata/RHSA-2019:1951

Comment 8 Product Security DevOps Team 2019-07-31 01:18:27 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11729

Comment 9 Joshua Padman 2019-07-31 05:13:00 UTC

This vulnerability is out of security support scope for the following product:
 * Red Hat Enterprise Application Platform 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 10 Mark Cooper 2019-10-08 01:18:39 UTC

The library nss-altfiles does not share any certificate code with nss. 
 * nss-altfiles only reads information from files in same format as /etc/passwd and /etc/group

Comment 12 errata-xmlrpc 2019-12-10 16:21:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:4190 https://access.redhat.com/errata/RHSA-2019:4190

Comment 16 Huzaifa S. Sidhpurwala 2019-12-20 05:09:26 UTC

Upstream commit: https://hg.mozilla.org/projects/nss/rev/dabfe1160c682b4d1d19c5a7a13ab3828bb9d37f
Upstream bug (currently private): https://bugzilla.mozilla.org/show_bug.cgi?id=1515342