CVE-2019-17006

Public on 2020-11-09
Modified on 2021-07-12
Description
A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.
Severity
Medium
CVSS v3 Base Score
8.1
See breakdown

Affected Packages

Platform Package Release Date Advisory
Amazon Linux 2 nspr 2020-11-09 21:02 ALAS2-2020-1559
Amazon Linux 2 nss-util 2020-11-09 21:02 ALAS2-2020-1559
Amazon Linux 2 nss-softokn 2020-11-09 21:02 ALAS2-2020-1559
Amazon Linux 2 nss 2020-11-09 21:02 ALAS2-2020-1559
Amazon Linux 1 nspr 2021-07-08 18:41 ALAS-2021-1522
Amazon Linux 1 nss-util 2021-07-08 18:41 ALAS-2021-1522
Amazon Linux 1 nss-softokn 2021-07-08 18:41 ALAS-2021-1522

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVSSv2 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
NVD CVSSv3 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H