CVE-2019-11727: mozilla firefox Improper Certificate Validation
Vulnerability summary
CVE-2019-11727 is a medium (CVSS 5.3) Improper Certificate Validation vulnerability in mozilla firefox. EPSS estimates a 1.81% chance of exploitation in the next 30 days, higher than 78.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 18 · Related 14Timeline
- 23-07-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
1.81%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
+0.07 pp
From 1.74% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu4 products
- firefox< 68.0+build3-0ubuntu0.16.04.1 | < 68.0+build3-0ubuntu0.18.04.1
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- thunderbird< 1:68.7.0+build1-0ubuntu0.16.04.2
Debian1 product
- nss< 2:3.45-1
Mozilla1 product
- firefox≥ unspecified, < 68 | < 68.0
3 vendors · 6 products
References
15 links- bugzilla.mozilla.org/show_bug.cgi?id=1552208X Refsource MISCIssue TrackingPermissions RequiredVendor Advisory
