Allele Security Intelligence

ASA-2019-00447 – Mozilla Firefox: PKCS#1 v1.5 signatures can be used for TLS 1.3

Posted on July 18, 2019July 18, 2019 by Allele Security Intelligence in Alerts

A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages.

ASA-2019-00440 – Mozilla Firefox: Out-of-bounds read when importing curve25519 private key

Posted on July 17, 2019July 17, 2019 by Allele Security Intelligence in Alerts

When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure.