Your submission was sent successfully! Close

Thank you for contacting our team. We will be in touch shortly. Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2023-5388

Published: 23 October 2023

NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

Notes

AuthorNote
mdeslaur
incomplete fix for CVE-2023-4421

Priority

Medium

Status

Package Release Status
firefox
Launchpad, Ubuntu, Debian
focal
Released (124.0+build1-0ubuntu0.20.04.1)
jammy Not vulnerable
(code not present)
mantic Not vulnerable
(code not present)
noble Not vulnerable
(code not present)
upstream Needs triage

mozjs102
Launchpad, Ubuntu, Debian
focal Does not exist

jammy Ignored

mantic Ignored
(end of life, was needs-triage)
noble Ignored

upstream Ignored

mozjs38
Launchpad, Ubuntu, Debian
bionic Ignored

focal Does not exist

jammy Does not exist

mantic Does not exist

noble Does not exist

upstream Ignored

mozjs52
Launchpad, Ubuntu, Debian
bionic Ignored

focal Ignored

jammy Does not exist

mantic Does not exist

noble Does not exist

upstream Ignored

mozjs68
Launchpad, Ubuntu, Debian
focal Ignored

jammy Does not exist

mantic Does not exist

noble Does not exist

upstream Ignored

mozjs78
Launchpad, Ubuntu, Debian
focal Does not exist

jammy Ignored

mantic Does not exist

noble Does not exist

upstream Ignored

mozjs91
Launchpad, Ubuntu, Debian
focal Does not exist

jammy Ignored

mantic Does not exist

noble Does not exist

upstream Ignored

nss
Launchpad, Ubuntu, Debian
bionic Needed

focal
Released (2:3.98-0ubuntu0.20.04.1)
jammy
Released (2:3.98-0ubuntu0.22.04.1)
lunar Ignored
(end of life, was deferred [2024-02-19])
mantic
Released (2:3.98-0ubuntu0.23.10.1)
noble Not vulnerable
(2:3.98-1)
trusty Needed

upstream
Released (3.90.2,3.98)
xenial Needed

Patches:
vendor: https://git.rockylinux.org/staging/rpms/nss/-/commit/1f7f7523b61a2ada2f461548c4160fbbf979c5dd
upstream: https://hg.mozilla.org/projects/nss/rev/196716d8377ab427e326f20bff2d026e90ac69e2
upstream: https://hg.mozilla.org/projects/nss/rev/b090a1e5dcdfc5772671063cfe9ebeadabd29ad3
thunderbird
Launchpad, Ubuntu, Debian
focal
Released (1:115.9.0+build1-0ubuntu0.20.04.1)
jammy
Released (1:115.9.0+build1-0ubuntu0.22.04.1)
mantic
Released (1:115.9.0+build1-0ubuntu0.23.10.1)
noble Not vulnerable
(code not present)
upstream Needs triage