What’s Vulnerable › Vulnerabilities

CVE-2019-17007

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-10-22 · updated 2026-06-17
• Weakness: CWE-295

Description

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.

Affected products

• Mozilla Network Security Services: before 3.44 — fixed in 3.44
• Siemens Ruggedcom Rox Mx5000 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1400 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1500 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1501 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1510 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1511 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx1512 Firmware: before 2.14.0 — fixed in 2.14.0
• Siemens Ruggedcom Rox Rx5000 Firmware: before 2.14.0 — fixed in 2.14.0

How to fix

Upgrade to a fixed version: Mozilla Network Security Services 3.44; Siemens Ruggedcom Rox Mx5000 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1400 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1500 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1501 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1510 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1511 Firmware 2.14.0; Siemens Ruggedcom Rox Rx1512 Firmware 2.14.0; Siemens Ruggedcom Rox Rx5000 Firmware 2.14.0. Check the vendor advisory for mitigations.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1533216
• https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf
• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44_release_notes
• https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04
• https://bugzilla.mozilla.org/show_bug.cgi?id=1533216
• https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf
• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44_release_notes
• https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04

Get alerted when CVE-2019-17007 or the next vulnerability affects your stack