{"id":"CVE-2023-4421","aliases":["BELL-CVE-2023-4421","DEBIAN-CVE-2023-4421","DLA-3634-1","EUVD-2023-54284","GHSA-3hpv-hgvq-792m","OESA-2026-2612","UBUNTU-CVE-2023-4421","USN-6727-1"],"status":"published","title":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting...","description":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS \u003c 3.61.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-13","score":0.00762,"percentile":0.55905,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203"],"published":"2023-10-18T13:44:55.276991Z","modified":"2026-10-26T18:01:42Z","fixes":[{"ecosystem":"Debian:12","package":"nss","fixed_in":["2:3.61-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nss","fixed_in":["2:3.61-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nss","fixed_in":["2:3.61-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nss","fixed_in":["3.54.0-13.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"nss","fixed_in":["2:3.98-0ubuntu0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.61-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.61-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.61-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.42.1-1+deb10u7"}]}],"versions":["2:3.42.1-1","2:3.42.1-1+deb10u1","2:3.42.1-1+deb10u2","2:3.42.1-1+deb10u3","2:3.42.1-1+deb10u4","2:3.42.1-1+deb10u5","2:3.42.1-1+deb10u6"],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.54.0-13.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.15.1-1ubuntu1","2:3.15.2-1","2:3.15.3-1","2:3.15.3.1-1","2:3.15.3.1-1.1","2:3.15.3.1-1.1ubuntu1","2:3.15.4-1ubuntu3","2:3.15.4-1ubuntu4","2:3.15.4-1ubuntu5","2:3.15.4-1ubuntu6","2:3.15.4-1ubuntu7","2:3.15.4-1ubuntu7.1","2:3.17-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.2","2:3.17.4-0ubuntu0.14.04.1","2:3.19.2-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.2","2:3.21-0ubuntu0.14.04.1","2:3.21-0ubuntu0.14.04.2","2:3.23-0ubuntu0.14.04.1","2:3.26.2-0ubuntu0.14.04.3","2:3.28.4-0ubuntu0.14.04.1","2:3.28.4-0ubuntu0.14.04.2","2:3.28.4-0ubuntu0.14.04.3","2:3.28.4-0ubuntu0.14.04.4","2:3.28.4-0ubuntu0.14.04.5","2:3.28.4-0ubuntu0.14.04.5+esm1","2:3.28.4-0ubuntu0.14.04.5+esm2","2:3.28.4-0ubuntu0.14.04.5+esm3","2:3.28.4-0ubuntu0.14.04.5+esm4","2:3.28.4-0ubuntu0.14.04.5+esm5","2:3.28.4-0ubuntu0.14.04.5+esm6","2:3.28.4-0ubuntu0.14.04.5+esm7","2:3.28.4-0ubuntu0.14.04.5+esm8","2:3.28.4-0ubuntu0.14.04.5+esm9","2:3.28.4-0ubuntu0.14.04.5+esm10","2:3.28.4-0ubuntu0.14.04.5+esm11","2:3.28.4-0ubuntu0.14.04.5+esm12","2:3.28.4-0ubuntu0.14.04.5+esm13","2:3.28.4-0ubuntu0.14.04.5+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.19.2-1ubuntu1","2:3.19.2.1-0ubuntu1","2:3.21-1ubuntu2","2:3.21-1ubuntu3","2:3.21-1ubuntu4","2:3.23-0ubuntu0.16.04.1","2:3.26.2-0ubuntu0.16.04.2","2:3.28.4-0ubuntu0.16.04.1","2:3.28.4-0ubuntu0.16.04.2","2:3.28.4-0ubuntu0.16.04.3","2:3.28.4-0ubuntu0.16.04.4","2:3.28.4-0ubuntu0.16.04.5","2:3.28.4-0ubuntu0.16.04.6","2:3.28.4-0ubuntu0.16.04.8","2:3.28.4-0ubuntu0.16.04.9","2:3.28.4-0ubuntu0.16.04.10","2:3.28.4-0ubuntu0.16.04.11","2:3.28.4-0ubuntu0.16.04.12","2:3.28.4-0ubuntu0.16.04.13","2:3.28.4-0ubuntu0.16.04.14","2:3.28.4-0ubuntu0.16.04.14+esm1","2:3.28.4-0ubuntu0.16.04.14+esm2","2:3.28.4-0ubuntu0.16.04.14+esm3","2:3.28.4-0ubuntu0.16.04.14+esm4","2:3.28.4-0ubuntu0.16.04.14+esm5","2:3.28.4-0ubuntu0.16.04.14+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.32-1ubuntu3","2:3.34-1ubuntu1","2:3.35-2ubuntu2","2:3.35-2ubuntu2.1","2:3.35-2ubuntu2.2","2:3.35-2ubuntu2.3","2:3.35-2ubuntu2.5","2:3.35-2ubuntu2.6","2:3.35-2ubuntu2.7","2:3.35-2ubuntu2.8","2:3.35-2ubuntu2.9","2:3.35-2ubuntu2.11","2:3.35-2ubuntu2.12","2:3.35-2ubuntu2.13","2:3.35-2ubuntu2.14","2:3.35-2ubuntu2.15","2:3.35-2ubuntu2.16","2:3.35-2ubuntu2.16+esm1","2:3.35-2ubuntu2.16+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.98-0ubuntu0.20.04.1"}]}],"versions":["2:3.45-1ubuntu2","2:3.47-1ubuntu1","2:3.47-1ubuntu2","2:3.48-1ubuntu1","2:3.49.1-1ubuntu1","2:3.49.1-1ubuntu1.1","2:3.49.1-1ubuntu1.2","2:3.49.1-1ubuntu1.4","2:3.49.1-1ubuntu1.5","2:3.49.1-1ubuntu1.6","2:3.49.1-1ubuntu1.7","2:3.49.1-1ubuntu1.8","2:3.49.1-1ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.98-0ubuntu0.20.04.1"}]}],"versions":["2:3.45-1ubuntu2","2:3.47-1ubuntu1","2:3.47-1ubuntu2","2:3.48-1ubuntu1","2:3.49.1-1ubuntu1","2:3.49.1-1ubuntu1.1","2:3.49.1-1ubuntu1.2","2:3.49.1-1ubuntu1.4","2:3.49.1-1ubuntu1.5","2:3.49.1-1ubuntu1.6","2:3.49.1-1ubuntu1.7","2:3.49.1-1ubuntu1.8","2:3.49.1-1ubuntu1.9"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.98-0ubuntu0.22.04.1"}]}],"versions":["2:3.68-1ubuntu1","2:3.68-1ubuntu2","2:3.68.2-0ubuntu1","2:3.68.2-0ubuntu1.1","2:3.68.2-0ubuntu1.2"],"bundled":3}],"products":[{"vendor":"mozilla","product":"nss"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1651411","tags":["x_transferred","Issue Tracking","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2023-53/","tags":["x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00039.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4421","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2023-53"},{"url":"https://github.com/advisories/GHSA-3hpv-hgvq-792m"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-4421","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-4421","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2612","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-4421","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4421","tags":["report"]},{"url":"https://people.redhat.com/~hkario/marvin/","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-53/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6727-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-5388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-6135","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-4421","description":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS \u003c 3.61.","status":"published","published":"2023-12-12T17:02:08.801Z","modified":"2025-11-04T19:25:18.22Z","updated_at":"2026-11-02T14:35:30.851125Z"}],"euvd":[{"id":"EUVD-2023-54284","description":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS \u003c 3.61.","status":"published","published":"2023-12-12T17:02:08Z","modified":"2025-11-04T19:25:18Z","updated_at":"2026-11-02T19:49:21.645169Z"}],"ghsa":[{"id":"GHSA-3hpv-hgvq-792m","title":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting...","description":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS \u003c 3.61.","status":"published","published":"2023-12-12T18:31:34Z","modified":"2025-11-04T21:31:59Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T15:04:38.133233Z"}],"nvd":[{"id":"CVE-2023-4421","description":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS \u003c 3.61.","status":"published","published":"2023-12-12T17:15:08.347Z","modified":"2026-06-17T06:37:47.547Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:08:54.010507Z"}],"osv":[{"id":"BELL-CVE-2023-4421","title":"CVE-2023-4421 does not affect BellSoft software","status":"withdrawn","published":"2023-10-18T13:44:55.276991Z","modified":"2026-01-26T09:47:09.873516Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-4421","description":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS \u003c 3.61.","status":"published","published":"2023-12-12T17:15:08.347Z","modified":"2026-03-14T14:54:44.711243Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"DEBIAN-CVE-2023-4421","description":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS \u003c 3.61.","status":"published","published":"2023-12-12T17:15:08.347Z","modified":"2026-10-26T18:01:42.996404542Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2026-2612","title":"nss security update","description":"Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.\r\n\r\nSecurity Fix(es):\n\nThe NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim\u0026apos;s key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS \u0026lt; 3.61.(CVE-2023-4421)","status":"published","published":"2026-06-12T11:11:33Z","modified":"2026-08-18T01:20:03.890505119Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2023-4421","description":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS \u003c 3.61.","status":"published","published":"2023-12-12T17:15:00Z","modified":"2026-10-21T23:00:14.841746829Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"DLA-3634-1","title":"nss - security update","status":"published","published":"2023-10-28T00:00:00Z","modified":"2026-03-09T01:21:10.206411Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"USN-6727-1","title":"nss vulnerabilities","description":"It was discovered that NSS incorrectly handled padding when checking PKCS#1\ncertificates. A remote attacker could possibly use this issue to perform\nBleichenbacher-like attacks and recover private data. This issue only\naffected Ubuntu 20.04 LTS. (CVE-2023-4421)\n\nIt was discovered that NSS had a timing side-channel when performing RSA\ndecryption. A remote attacker could possibly use this issue to recover\nprivate data. (CVE-2023-5388)\n\nIt was discovered that NSS had a timing side-channel when using certain\nNIST curves. A remote attacker could possibly use this issue to recover\nprivate data. (CVE-2023-6135)\n\nThe NSS package contained outdated CA certificates. This update refreshes\nthe NSS package to version 3.98 which includes the latest CA certificate\nbundle and other security improvements.\n","status":"published","published":"2024-04-10T13:40:08Z","modified":"2026-04-27T17:12:02.385372Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}