What’s Vulnerable › Vulnerabilities

CVE-2019-17006

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-10-22 · updated 2026-06-17
• Weakness: CWE-20

Description

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

Affected products

• Mozilla Network Security Services: before 3.46 — fixed in 3.46
• NetApp Hci Compute Node: all versions
• NetApp Hci Management Node: all versions
• NetApp Hci Storage Node: all versions
• NetApp Solidfire: all versions
• Siemens Ruggedcom Rox Mx5000 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1400 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1500 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1501 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1510 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1511 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1512 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx5000 Firmware: before 2.14.0 — fixed in 2.14.0

How to fix

Upgrade to a fixed version: Mozilla Network Security Services 3.46; Siemens Ruggedcom Rox Mx5000 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1400 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1500 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1501 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1510 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1511 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1512 Firmware 2.14.0; Siemens Ruggedcom Rox Rx5000 Firmware 2.14.0. Check the vendor advisory for mitigations.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1539788
• https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf
• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes
• https://security.netapp.com/advisory/ntap-20210129-0001/
• https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04
• https://bugzilla.mozilla.org/show_bug.cgi?id=1539788
• https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf
• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes
• https://security.netapp.com/advisory/ntap-20210129-0001/
• https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04

Get alerted when CVE-2019-17006 or the next vulnerability affects your stack