{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5388", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2023-10-04T17:22:36.090Z", "datePublished": "2024-03-19T12:02:54.004Z", "dateUpdated": "2025-02-13T17:25:28.560Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThan": "124", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Firefox ESR", "vendor": "Mozilla", "versions": [{"lessThan": "115.9", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThan": "115.9", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9."}]}], "problemTypes": [{"descriptions": [{"description": "NSS susceptible to timing attack against RSA decryption", "lang": "en", "type": "text"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1780432"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-12/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-13/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-14/"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html"}], "credits": [{"lang": "en", "value": "Hubert Kario"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2024-03-25T17:06:07.771Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-03-19T15:53:28.013217Z", "id": "CVE-2023-5388", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-14T21:31:10.506Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:59:43.260Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1780432", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-12/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-13/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-14/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1780432", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-12/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-13/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-14/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:59:43.260Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-5388", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-19T15:53:28.013217Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:38.130Z"}}], "cna": {"credits": [{"lang": "en", "value": "Hubert Kario"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "124", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "115.9", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "115.9", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1780432"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-12/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-13/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2024-14/"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html"}], "descriptions": [{"lang": "en", "value": "NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.", "supportingMedia": [{"type": "text/html", "value": "NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "NSS susceptible to timing attack against RSA decryption"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2024-03-25T17:06:07.771Z"}}}, "cveMetadata": {"cveId": "CVE-2023-5388", "state": "PUBLISHED", "dateUpdated": "2025-02-13T17:25:28.560Z", "dateReserved": "2023-10-04T17:22:36.090Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2024-03-19T12:02:54.004Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9."}, {"lang": "es", "value": "NSS era susceptible a un ataque de canal lateral de sincronizaci\u00f3n al realizar el descifrado RSA. Este ataque podr\u00eda permitir potencialmente que un atacante recupere los datos privados. Esta vulnerabilidad afecta a Firefox &lt; 124, Firefox ESR &lt; 115.9 y Thunderbird &lt; 115.9."}], "id": "CVE-2023-5388", "lastModified": "2024-11-21T08:41:40.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-03-19T12:15:07.537", "references": [{"source": "security@mozilla.org", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1780432"}, {"source": "security@mozilla.org", "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html"}, {"source": "security@mozilla.org", "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2024-12/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2024-13/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2024-14/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1780432"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00028.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.mozilla.org/security/advisories/mfsa2024-12/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.mozilla.org/security/advisories/mfsa2024-13/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.mozilla.org/security/advisories/mfsa2024-14/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Awaiting Analysis"}

{"acknowledgement": "This issue was discovered by Hubert Kario (Red Hat).", "affected_release": [{"advisory": "RHSA-2024:1486", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:115.9.1-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1498", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:115.9.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:0105", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "nss-0:3.90.0-4.el8_9", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-01-10T00:00:00Z"}, {"advisory": "RHSA-2024:1484", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:115.9.1-1.el8_9", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1494", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:115.9.0-1.el8_9", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1490", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "firefox-0:115.9.1-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1500", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "thunderbird-0:115.9.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1490", "cpe": "cpe:/a:redhat:rhel_tus:8.2", "package": "firefox-0:115.9.1-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1500", "cpe": "cpe:/a:redhat:rhel_tus:8.2", "package": "thunderbird-0:115.9.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1490", "cpe": "cpe:/a:redhat:rhel_e4s:8.2", "package": "firefox-0:115.9.1-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1500", "cpe": "cpe:/a:redhat:rhel_e4s:8.2", "package": "thunderbird-0:115.9.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1491", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "firefox-0:115.9.1-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1499", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "thunderbird-0:115.9.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1491", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "firefox-0:115.9.1-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1499", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "thunderbird-0:115.9.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1491", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "firefox-0:115.9.1-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1499", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "thunderbird-0:115.9.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:0106", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "nss-0:3.79.0-12.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2024-01-10T00:00:00Z"}, {"advisory": "RHSA-2024:1489", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "firefox-0:115.9.1-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1497", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "thunderbird-0:115.9.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:0093", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "nss-0:3.90.0-4.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-01-09T00:00:00Z"}, {"advisory": "RHSA-2024:1488", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "firefox-0:115.9.1-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1496", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "thunderbird-0:115.9.0-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:0108", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "nss-0:3.90.0-4.el9_3", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-01-10T00:00:00Z"}, {"advisory": "RHSA-2024:1485", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "firefox-0:115.9.1-1.el9_3", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1493", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "thunderbird-0:115.9.0-1.el9_3", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1487", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "firefox-0:115.9.1-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1495", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "thunderbird-0:115.9.0-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:0107", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "nss-0:3.90.0-4.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-01-10T00:00:00Z"}, {"advisory": "RHSA-2024:1483", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "firefox-0:115.9.1-1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-03-25T00:00:00Z"}, {"advisory": "RHSA-2024:1492", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "thunderbird-0:115.9.0-1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2024-03-25T00:00:00Z"}], "bugzilla": {"description": "nss: timing attack against RSA decryption", "id": "2243644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243644"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-208", "details": ["NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.", "It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a Bleichenbacher or Manger like attack against all RSA decryption operations. As the leak happens before any padding operations, it affects all padding modes: PKCS#1 v1.5, OAEP, and RSASVP. Both API level calls and TLS server operation are affected."], "name": "CVE-2023-5388", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "nss", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "nss", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2023-10-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-5388\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-5388\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2024-13/#CVE-2023-5388\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2024-14/#CVE-2023-5388"], "threat_severity": "Moderate", "upstream_fix": "firefox 115.9, thunderbird 115.9"}