critical 9.8

CVE-2019-17006 json

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks.

published 2020-10-22 6y ago modified 2026-06-17 4mo ago also EUVD-2019-7480

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 3.5%; EPSS 3.5% chance of exploitation in 30 days, percentile 89%
public exploits: 0; none known

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

Patch / fix

fixed in 1 distros 6 links 1

Mozilla NSS 3.46

debian ubuntu red hat suse opensuse rocky linux

nss Debian 14, Debian 13, Debian 12 2:3.47-1

debian advisories DEBIAN-CVE-2019-17006

nss Ubuntu 16.04 LTS 2:3.28.4-0ubuntu0.16.04.10
nss Ubuntu 18.04 LTS 2:3.35-2ubuntu2.7
nss Ubuntu Pro 14.04 LTS 2:3.28.4-0ubuntu0.14.04.5+esm4

ubuntu advisories UBUNTU-CVE-2019-17006

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

nss RHEL 7 3.53.1-3.el7_9
nspr RHEL 7 4.25.0-2.el7_9
nss-util RHEL 7 3.53.1-1.el7_9
nss-tools RHEL 7 3.53.1-3.el7_9
nss-softokn RHEL 7 3.53.1-6.el7_9
nss-sysinit RHEL 7 3.53.1-3.el7_9
nss-softokn-freebl RHEL 7 3.53.1-6.el7_9
nss RHEL 8 3.53.1-11.el8_2

red hat advisories RHSA-2021:1026 RHSA-2021:0876 RHSA-2021:0758 RHSA-2020:4076 RHSA-2020:3280

mozilla-nss SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +15 more 3.53.1-58.48.1
mozilla-nspr SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +15 more 4.25-19.15.1
mozilla-nss SLES for SAP 15, SLES 15-LTSS, SLE Module for Server Applications 15 SP2 +5 more 3.53-3.40.1
mozilla-nspr SLES for SAP 15, SLES 15-LTSS, SLE Module for Basesystem 15 SP2 +3 more 4.25-3.12.1
mozilla-nss SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +17 more 3.47.1-58.34.1
mozilla-nspr SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +17 more 4.23-19.12.1
mozilla-nss SLE Module for Server Applications 15 SP1, SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 3.47.1-3.22.1
mozilla-nspr SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 4.23-3.9.1

suse advisories SUSE-SU-2020:14418-1 SUSE-SU-2020:1839-1 SUSE-SU-2020:1677-1 SUSE-SU-2020:0088-1 SUSE-SU-2019:3395-1

mozilla-nss openSUSE Tumbleweed 3.69.1-1.2
mozilla-nss openSUSE Leap 15.1 3.53-lp151.2.23.1
mozilla-nspr openSUSE Leap 15.1 4.25-lp151.2.9.1
mozilla-nss openSUSE Leap 15.1 3.47.1-lp151.2.9.1
mozilla-nspr openSUSE Leap 15.1 4.23-lp151.2.6.1

opensuse advisories openSUSE-SU-2024:11058-1 openSUSE-SU-2020:0854-1 openSUSE-SU-2020:0008-1

nspr Rocky Linux 8 4.25.0-2.el8_2

rocky linux advisories RLSA-2020:3280

bugzilla.mozilla.org/show_bug.cgi?id=1539788 advisory

Is CVE-2019-17006 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-17006 updated 2026-11-05 cvss 8.1

nss: Check length of inputs for cryptographic primitives

Red Hat Enterprise Linux 6 nss, nss-tools, nss-sysinit
affected: no fix planned “Out of support scope”
Red Hat OpenShift Do 1 openshiftdo/odo-init-image-rhel7 1.1.3-2
fixed: vendor fix RHSA-2021:0949
Red Hat Enterprise Linux AppStream (v. 8) nspr 4.25.0-2.el8_2, nss 3.53.1-11.el8_2, nss-util 3.53.1-11.el8_2, nss-tools 3.53.1-11.el8_2, nss-softokn 3.53.1-11.el8_2, nss-sysinit 3.53.1-11.el8_2, +1 more
fixed: vendor fix RHSA-2020:3280
Red Hat Enterprise Linux Client (v. 7) nss 3.53.1-3.el7_9, nspr 4.25.0-2.el7_9, nss-util 3.53.1-1.el7_9, nss-tools 3.53.1-3.el7_9, nss-softokn 3.53.1-6.el7_9, nss-sysinit 3.53.1-3.el7_9, +1 more Red Hat Enterprise Linux Client Optional (v. 7) nss-devel 3.53.1-3.el7_9, nspr-devel 4.25.0-2.el7_9, nss-debuginfo 3.53.1-3.el7_9, nspr-debuginfo 4.25.0-2.el7_9, nss-util-devel 3.53.1-1.el7_9, nss-pkcs11-devel 3.53.1-3.el7_9, +4 more
fixed: vendor fix RHSA-2020:4076
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) nss 3.36.0-9.el7_6, nss-tools 3.36.0-9.el7_6, nss-softokn 3.36.0-7.el7_6, nss-sysinit 3.36.0-9.el7_6, nss-softokn-freebl 3.36.0-7.el7_6
fixed: vendor fix RHSA-2021:0876
Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) nss-softokn 3.44.0-9.el7_7, nss-softokn-freebl 3.44.0-9.el7_7
fixed: vendor fix RHSA-2021:1026
Red Hat Enterprise Linux ComputeNode Optional (v. 7) nss-devel 3.53.1-3.el7_9, nspr-devel 4.25.0-2.el7_9, nss-debuginfo 3.53.1-3.el7_9, nspr-debuginfo 4.25.0-2.el7_9, nss-util-devel 3.53.1-1.el7_9, nss-pkcs11-devel 3.53.1-3.el7_9, +4 more
fixed: vendor fix RHSA-2020:4076
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) nss-devel 3.36.0-9.el7_6, nss-debuginfo 3.36.0-9.el7_6, nss-pkcs11-devel 3.36.0-9.el7_6, nss-softokn-devel 3.36.0-7.el7_6, nss-softokn-debuginfo 3.36.0-7.el7_6, nss-softokn-freebl-devel 3.36.0-7.el7_6
fixed: vendor fix RHSA-2021:0876

show 10 more

Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) nss-softokn-devel 3.44.0-9.el7_7, nss-softokn-debuginfo 3.44.0-9.el7_7, nss-softokn-freebl-devel 3.44.0-9.el7_7
fixed: vendor fix RHSA-2021:1026
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) nss 3.36.0-9.el7_6, nss-tools 3.36.0-9.el7_6, nss-softokn 3.36.0-7.el7_6, nss-sysinit 3.36.0-9.el7_6, nss-softokn-freebl 3.36.0-7.el7_6 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) nss-debuginfo 3.36.0-9.el7_6, nss-pkcs11-devel 3.36.0-9.el7_6
fixed: vendor fix RHSA-2021:0876
Red Hat Enterprise Linux Server (v. 7) nss 3.53.1-3.el7_9, nspr 4.25.0-2.el7_9, nss-util 3.53.1-1.el7_9, nss-tools 3.53.1-3.el7_9, nss-softokn 3.53.1-6.el7_9, nss-sysinit 3.53.1-3.el7_9, +1 more
fixed: vendor fix RHSA-2020:4076
Red Hat Enterprise Linux Server AUS (v. 7.4) nss-softokn 3.28.3-10.el7_4, nss-softokn-freebl 3.28.3-10.el7_4 Red Hat Enterprise Linux Server E4S (v. 7.4) nss-softokn 3.28.3-10.el7_4, nss-softokn-freebl 3.28.3-10.el7_4
fixed: vendor fix RHSA-2021:0758
Red Hat Enterprise Linux Server EUS (v. 7.6) nss 3.36.0-9.el7_6, nss-tools 3.36.0-9.el7_6, nss-softokn 3.36.0-7.el7_6, nss-sysinit 3.36.0-9.el7_6, nss-softokn-freebl 3.36.0-7.el7_6
fixed: vendor fix RHSA-2021:0876
Red Hat Enterprise Linux Server EUS (v. 7.7) nss-softokn 3.44.0-9.el7_7, nss-softokn-freebl 3.44.0-9.el7_7
fixed: vendor fix RHSA-2021:1026
Red Hat Enterprise Linux Server Optional (v. 7) nss-debuginfo 3.53.1-3.el7_9, nss-pkcs11-devel 3.53.1-3.el7_9
fixed: vendor fix RHSA-2020:4076
Red Hat Enterprise Linux Server Optional EUS (v. 7.6) nss-debuginfo 3.36.0-9.el7_6, nss-pkcs11-devel 3.36.0-9.el7_6
fixed: vendor fix RHSA-2021:0876
Red Hat Enterprise Linux Server TUS (v. 7.4) nss-softokn 3.28.3-10.el7_4, nss-softokn-freebl 3.28.3-10.el7_4
fixed: vendor fix RHSA-2021:0758
Red Hat Enterprise Linux Workstation (v. 7) nss 3.53.1-3.el7_9, nspr 4.25.0-2.el7_9, nss-util 3.53.1-1.el7_9, nss-tools 3.53.1-3.el7_9, nss-softokn 3.53.1-6.el7_9, nss-sysinit 3.53.1-3.el7_9, +1 more Red Hat Enterprise Linux Workstation Optional (v. 7) nss-debuginfo 3.53.1-3.el7_9, nss-pkcs11-devel 3.53.1-3.el7_9
fixed: vendor fix RHSA-2020:4076

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-21-040-04 updated 2021-02-09 cvss 9.8

Siemens RUGGEDCOM ROX II

Siemens RUGGEDCOM ROX MX5000 <V2.14.0 Siemens RUGGEDCOM ROX RX1400 <V2.14.0 Siemens RUGGEDCOM ROX RX1500 <V2.14.0 Siemens RUGGEDCOM ROX RX1501 <V2.14.0 Siemens RUGGEDCOM ROX RX1510 <V2.14.0 Siemens RUGGEDCOM ROX RX1511 <V2.14.0

+2 more productsfewer

Siemens RUGGEDCOM ROX RX1512 <V2.14.0 Siemens RUGGEDCOM ROX RX5000 <V2.14.0

affected: fixed in V2.14.0, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

3.51% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=1539788 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

Mozilla NSS

Classification

Weakness

CWE-20 Improper Input Validation
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

bugzilla.mozilla.org /show_bug.cgi?id=1539788
exploit, issue-tracking, patch, vendor-advisory
developer.mozilla.org /en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes
release-notes, vendor-advisory
security.netapp.com /advisory/ntap-20210129-0001/
third-party-advisory
cert-portal.siemens.com /productcert/pdf/ssa-379803.pdf
third-party-advisory
us-cert.cisa.gov /ics/advisories/icsa-21-040-04
third-party-advisory, us-government-resource

Sources

CVE List CVE-2019-17006
NVD CVE-2019-17006

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed