CVE-2021-43527
Vulnerability Summary
Timeline
Description
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
CVSS Metrics
- v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS Trends
Current EPSS score: 17.56%• Percentile: 97%
Techniques & Countermeasures
- CWE-787•Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Affected Systems
- alpine•nss
< 3.60-r2 | < 3.73-r0 | < 3.73-r0 | < 3.73-r0 | < 3.73-r0 | < 3.73-r0 | < 3.73-r0
- debian•nss
< 2:3.61-1+deb11u1 | < 2:3.73-1 | < 2:3.73-1 | < 2:3.73-1
- mozilla•nss
≥ unspecified, < 3.73 | ≥ unspecified, < 3.68.1 | < 3.73
- mozilla•nss_esr
< 3.68.1
- netapp•cloud_backup
na
- netapp•e-series_santricity_os_controller
≥ 11.0, ≤ 11.70.1
- oracle•communications_cloud_native_core_binding_support_function
1.11.0
- oracle•communications_cloud_native_core_network_repository_function
1.15.0 | 1.15.1
- oracle•communications_cloud_native_core_network_slice_selection_function
1.8.0
- oracle•communications_policy_management
12.6.0.0.0
- redhat•nss
< 0:3.67.0-7.el8_5 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.44.0-12.el6_10 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.28.4-18.el7_4 | < 0:3.36.0-10.2.el7_6 | < 0:3.44.0-8.el7_7 | < 0:3.44.0-10.el8_1 | < 0:3.28.4-2.el7_3
- redhat•nss-debuginfo
< 0:3.67.0-7.el8_5 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.44.0-12.el6_10 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.28.4-18.el7_4 | < 0:3.36.0-10.2.el7_6 | < 0:3.44.0-8.el7_7 | < 0:3.44.0-10.el8_1 | < 0:3.28.4-2.el7_3
- redhat•nss-debugsource
< 0:3.67.0-7.el8_5 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.44.0-10.el8_1
- redhat•nss-devel
< 0:3.67.0-7.el8_5 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.44.0-12.el6_10 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.28.4-18.el7_4 | < 0:3.36.0-10.2.el7_6 | < 0:3.44.0-8.el7_7 | < 0:3.44.0-10.el8_1 | < 0:3.28.4-2.el7_3
- redhat•nss-pkcs11-devel
< 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.44.0-12.el6_10 | < 0:3.28.4-18.el7_4 | < 0:3.36.0-10.2.el7_6 | < 0:3.44.0-8.el7_7 | < 0:3.28.4-2.el7_3
- redhat•nss-softokn
< 0:3.67.0-7.el8_5 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.44.0-10.el8_1
- redhat•nss-softokn-debuginfo
< 0:3.67.0-7.el8_5 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.44.0-10.el8_1
- redhat•nss-softokn-devel
< 0:3.67.0-7.el8_5 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.44.0-10.el8_1
- redhat•nss-softokn-freebl
< 0:3.67.0-7.el8_5 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.44.0-10.el8_1
- redhat•nss-softokn-freebl-debuginfo
< 0:3.67.0-7.el8_5 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.44.0-10.el8_1
- redhat•nss-softokn-freebl-devel
< 0:3.67.0-7.el8_5 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.44.0-10.el8_1
- redhat•nss-sysinit
< 0:3.67.0-7.el8_5 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.44.0-12.el6_10 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.28.4-18.el7_4 | < 0:3.36.0-10.2.el7_6 | < 0:3.44.0-8.el7_7 | < 0:3.44.0-10.el8_1 | < 0:3.28.4-2.el7_3
- redhat•nss-sysinit-debuginfo
< 0:3.67.0-7.el8_5 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.44.0-10.el8_1
- redhat•nss-tools
< 0:3.67.0-7.el8_5 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.67.0-4.el7_9 | < 0:3.44.0-12.el6_10 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.28.4-18.el7_4 | < 0:3.36.0-10.2.el7_6 | < 0:3.44.0-8.el7_7 | < 0:3.44.0-10.el8_1 | < 0:3.28.4-2.el7_3
- redhat•nss-tools-debuginfo
< 0:3.67.0-7.el8_5 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.44.0-10.el8_1
- redhat•nss-util
< 0:3.67.0-7.el8_5 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.44.0-10.el8_1
- redhat•nss-util-debuginfo
< 0:3.67.0-7.el8_5 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.44.0-10.el8_1
- redhat•nss-util-devel
< 0:3.67.0-7.el8_5 | < 0:3.67.0-7.el8_4 | < 0:3.53.1-12.el8_2 | < 0:3.44.0-10.el8_1
- redhat•redhat-virtualization-host
< 0:4.4.9-202112061811_8.5
- redhat•redhat-virtualization-host-image-update
< 0:4.4.9-202112061811_8.5
- redhat•thunderbird
< 0:91.3.0-3.el8_2 | < 0:91.3.0-3.el8_1
- redhat•thunderbird-debuginfo
< 0:91.3.0-3.el8_2 | < 0:91.3.0-3.el8_1
- redhat•thunderbird-debugsource
< 0:91.3.0-3.el8_2 | < 0:91.3.0-3.el8_1
- starwindsoftware•starwind_san_\&_nas
v8r13
- starwindsoftware•starwind_virtual_san
v8r13:14398
References (46)
- https://www.mozilla.org/security/advisories/mfsa2021-51/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1737470
- https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_73_RTM/
- https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_68_1_RTM/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20211229-0002/
- https://cert-portal.siemens.com/productcert/pdf/ssa-594438.pdf
- https://www.starwindsoftware.com/security/sw-20220802-0001/
- https://security.gentoo.org/glsa/202212-05
- https://access.redhat.com/errata/RHSA-2021:4903
- https://access.redhat.com/security/vulnerabilities/RHSB-2021-008
- https://access.redhat.com/security/updates/classification/#critical
- https://bugzilla.redhat.com/show_bug.cgi?id=2024370
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4903.json
- https://access.redhat.com/security/cve/CVE-2021-43527
- https://www.cve.org/CVERecord?id=CVE-2021-43527
- https://nvd.nist.gov/vuln/detail/CVE-2021-43527
- https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html
- https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/
- https://access.redhat.com/errata/RHSA-2021:4904
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4904.json
- https://access.redhat.com/errata/RHSA-2021:4907
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4907.json
- https://access.redhat.com/errata/RHSA-2021:4909
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4909.json
- https://access.redhat.com/errata/RHSA-2021:4919
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4919.json
- https://access.redhat.com/errata/RHSA-2021:4932
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4932.json
- https://access.redhat.com/errata/RHSA-2021:4933
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4933.json
- https://access.redhat.com/errata/RHSA-2021:4946
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4946.json
- https://access.redhat.com/errata/RHSA-2021:4953
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4953.json
- https://access.redhat.com/errata/RHSA-2021:4954
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4954.json
- https://access.redhat.com/errata/RHSA-2021:4969
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4969.json
- https://access.redhat.com/errata/RHSA-2021:4994
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4994.json
- https://access.redhat.com/errata/RHSA-2021:5006
- https://bugzilla.redhat.com/show_bug.cgi?id=2029406
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5006.json
- https://security-tracker.debian.org/tracker/CVE-2021-43527
- https://security.alpinelinux.org/vuln/CVE-2021-43527