CVE catalog

CVE-2019-17023

nss: CVE-2019-17023

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.34% · Oct 25, 2026

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannsssid2:3.131.1-1fixed
Debiannssforky2:3.131.1-1fixed
Debiannsstrixie2:3.110-1+deb13u4fixed
Debiannsstrixie-security2:3.110-1+deb13u4fixed
Debiannssbookworm2:3.87.1-1+deb12u2fixed
Debiannssbookworm-security2:3.87.1-1+deb12u4fixed
Alpinenss3.123.49-r0fixed
Alpinenss3.193.49-r0fixed
Alpinenss3.203.49-r0fixed
Alpinenss3.213.49-r0fixed
Alpinenss3.223.49-r0fixed
Alpinenss3.233.49-r0fixed
Alpinenss3.243.49-r0fixed
Ubuntufirefox16.0441.0.2+build2-0ubuntu1vulnerable
Ubuntufirefox16.0442.0+build2-0ubuntu1vulnerable
Ubuntufirefox16.0444.0+build3-0ubuntu2vulnerable
Ubuntufirefox16.0444.0.1+build1-0ubuntu1vulnerable
Ubuntufirefox16.0444.0.2+build1-0ubuntu1vulnerable
Ubuntufirefox16.0445.0+build2-0ubuntu1vulnerable
Ubuntufirefox16.0445.0.1+build1-0ubuntu1vulnerable
Ubuntufirefox16.0445.0.2+build1-0ubuntu1vulnerable
Ubuntufirefox16.0446.0+build5-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0446.0.1+build1-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0447.0+build3-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0448.0+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0449.0+build4-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0449.0.2+build2-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0450.0+build2-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0450.0.2+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0450.1.0+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0451.0.1+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0451.0.1+build2-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0452.0+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0452.0.1+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0452.0.2+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0453.0+build6-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0453.0.2+build1-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0453.0.3+build1-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0454.0+build3-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0455.0.1+build2-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0455.0.2+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0456.0+build6-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0456.0+build6-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0457.0+build4-0ubuntu0.16.04.5vulnerable
Ubuntufirefox16.0457.0+build4-0ubuntu0.16.04.6vulnerable
Ubuntufirefox16.0457.0.1+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0457.0.3+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0457.0.4+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0458.0+build6-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0458.0.1+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0458.0.2+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0459.0+build5-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0459.0.1+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0459.0.2+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0459.0.2+build1-0ubuntu0.16.04.3vulnerable
Ubuntufirefox16.0460.0+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0460.0.1+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0460.0.2+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0461.0+build3-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0461.0.1+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0462.0+build2-0ubuntu0.16.04.3vulnerable
Ubuntufirefox16.0462.0+build2-0ubuntu0.16.04.4vulnerable
Ubuntufirefox16.0462.0+build2-0ubuntu0.16.04.5vulnerable
Ubuntufirefox16.0462.0.3+build1-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0463.0+build2-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0463.0.3+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0464.0+build3-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0465.0+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0465.0.1+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0466.0+build3-0ubuntu0.16.04.2vulnerable
Ubuntufirefox16.0466.0.1+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0466.0.2+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0466.0.3+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0466.0.4+build3-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0466.0.5+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0467.0+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0467.0.1+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0467.0.2+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0467.0.3+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0467.0.4+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0468.0+build3-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0468.0.1+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0468.0.2+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0469.0+build2-0ubuntu0.16.04.4vulnerable
Ubuntufirefox16.0469.0.1+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0469.0.2+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0470.0+build2-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0470.0.1+build1-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0471.0+build5-0ubuntu0.16.04.1vulnerable
Ubuntufirefox16.0472.0.1+build1-0ubuntu0.16.04.1fixed
Ubuntufirefox18.0456.0+build6-0ubuntu1vulnerable
Ubuntufirefox18.0457.0.1+build2-0ubuntu1vulnerable
Ubuntufirefox18.0459.0.1+build1-0ubuntu1vulnerable
Ubuntufirefox18.0459.0.2+build1-0ubuntu1vulnerable
Ubuntufirefox18.0460.0+build2-0ubuntu1vulnerable
Ubuntufirefox18.0460.0.1+build2-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0460.0.2+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0461.0+build3-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0461.0.1+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0462.0+build2-0ubuntu0.18.04.3vulnerable
Ubuntufirefox18.0462.0+build2-0ubuntu0.18.04.4vulnerable
Ubuntufirefox18.0462.0+build2-0ubuntu0.18.04.5vulnerable
Ubuntufirefox18.0462.0.3+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0463.0+build2-0ubuntu0.18.04.2vulnerable
Ubuntufirefox18.0463.0.3+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0464.0+build3-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0465.0+build2-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0465.0.1+build2-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0466.0+build3-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0466.0.1+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0466.0.2+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0466.0.3+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0466.0.4+build3-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0466.0.5+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0467.0+build2-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0467.0.1+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0467.0.2+build2-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0467.0.3+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0467.0.4+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0468.0+build3-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0468.0.1+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0468.0.2+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0469.0+build2-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0469.0.1+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0469.0.2+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0470.0+build2-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0470.0.1+build1-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0471.0+build5-0ubuntu0.18.04.1vulnerable
Ubuntufirefox18.0472.0.1+build1-0ubuntu0.18.04.1fixed
Ubuntunss18.042:3.32-1ubuntu3vulnerable
Ubuntunss18.042:3.34-1ubuntu1vulnerable
Ubuntunss18.042:3.35-2ubuntu2vulnerable
Ubuntunss18.042:3.35-2ubuntu2.1vulnerable
Ubuntunss18.042:3.35-2ubuntu2.2vulnerable
Ubuntunss18.042:3.35-2ubuntu2.3vulnerable
Ubuntunss18.042:3.35-2ubuntu2.5vulnerable
Ubuntunss18.042:3.35-2ubuntu2.6vulnerable
Ubuntunss18.042:3.35-2ubuntu2.7vulnerable
Ubuntunss18.042:3.35-2ubuntu2.8fixed
Ubuntufirefox20.0469.0.3+build1-0ubuntu1vulnerable
Ubuntufirefox20.0470.0+build2-0ubuntu1vulnerable
Ubuntufirefox20.0470.0+build2-0ubuntu2vulnerable
Ubuntufirefox20.0470.0.1+build1-0ubuntu2vulnerable
Ubuntufirefox20.0471.0+build2-0ubuntu2vulnerable
Ubuntufirefox20.0471.0+build5-0ubuntu1vulnerable
Ubuntufirefox20.0472.0.1+build1-0ubuntu1fixed
Ubuntunss16.042:3.19.2-1ubuntu1vulnerable
Ubuntunss16.042:3.19.2.1-0ubuntu1vulnerable
Ubuntunss16.042:3.21-1ubuntu2vulnerable
Ubuntunss16.042:3.21-1ubuntu3vulnerable
Ubuntunss16.042:3.21-1ubuntu4vulnerable
Ubuntunss16.042:3.23-0ubuntu0.16.04.1vulnerable
Ubuntunss16.042:3.26.2-0ubuntu0.16.04.2vulnerable
Ubuntunss16.042:3.28.4-0ubuntu0.16.04.1vulnerable
Ubuntunss16.042:3.28.4-0ubuntu0.16.04.2vulnerable
Ubuntunss16.042:3.28.4-0ubuntu0.16.04.3vulnerable
Ubuntunss16.042:3.28.4-0ubuntu0.16.04.4vulnerable
Ubuntunss16.042:3.28.4-0ubuntu0.16.04.5vulnerable
Ubuntunss16.042:3.28.4-0ubuntu0.16.04.6vulnerable
Ubuntunss16.042:3.28.4-0ubuntu0.16.04.8vulnerable
Ubuntunss16.042:3.28.4-0ubuntu0.16.04.9vulnerable
Ubuntunss16.042:3.28.4-0ubuntu0.16.04.10vulnerable
Ubuntunss16.042:3.28.4-0ubuntu0.16.04.11fixed
Ubuntunss18.042:3.32-1ubuntu3vulnerable
Ubuntunss18.042:3.34-1ubuntu1vulnerable
Ubuntunss18.042:3.35-2ubuntu2vulnerable
Ubuntunss18.042:3.35-2ubuntu2.1vulnerable
Ubuntunss18.042:3.35-2ubuntu2.2vulnerable
Ubuntunss18.042:3.35-2ubuntu2.3vulnerable
Ubuntunss18.042:3.35-2ubuntu2.5vulnerable
Ubuntunss18.042:3.35-2ubuntu2.6vulnerable
Ubuntunss18.042:3.35-2ubuntu2.7vulnerable
Ubuntunss18.042:3.35-2ubuntu2.8fixed
Ubuntunss20.042:3.45-1ubuntu2vulnerable
Ubuntunss20.042:3.47-1ubuntu1vulnerable
Ubuntunss20.042:3.47-1ubuntu2vulnerable
Ubuntunss20.042:3.48-1ubuntu1vulnerable
Ubuntunss20.042:3.49.1-1ubuntu1vulnerable
Ubuntunss20.042:3.49.1-1ubuntu1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannsssourcesid2:3.49-1not yet assignedNot reportedNot reported
Debiannsssourceforky2:3.49-1not yet assignedNot reportedNot reported
Debiannsssourcetrixie2:3.49-1not yet assignedNot reportedNot reported
Debiannsssourcebookworm2:3.49-1not yet assignedNot reportedNot reported
Alpinenssapk3.123.49-r0Not reportedALPINE-CVE-2019-17023Not reported
Alpinenssapk3.193.49-r0Not reportedALPINE-CVE-2019-17023Not reported
Alpinenssapk3.203.49-r0Not reportedALPINE-CVE-2019-17023Not reported
Alpinenssapk3.213.49-r0Not reportedALPINE-CVE-2019-17023Not reported
Alpinenssapk3.223.49-r0Not reportedALPINE-CVE-2019-17023Not reported
Alpinenssapk3.233.49-r0Not reportedALPINE-CVE-2019-17023Not reported
Alpinenssapk3.243.49-r0Not reportedALPINE-CVE-2019-17023Not reported
Ubuntufirefoxdeb16.0472.0.1+build1-0ubuntu0.16.04.1Not reportedUBUNTU-CVE-2019-17023Not reported
Ubuntufirefoxdeb18.0472.0.1+build1-0ubuntu0.18.04.1Not reportedUBUNTU-CVE-2019-17023Not reported
Ubuntunssdeb18.042:3.35-2ubuntu2.8Not reportedUBUNTU-CVE-2019-17023Not reported
Ubuntufirefoxdeb20.0472.0.1+build1-0ubuntu1Not reportedUBUNTU-CVE-2019-17023Not reported
Ubuntunssdeb16.042:3.28.4-0ubuntu0.16.04.11Not reportedUSN-4397-1Not reported
Ubuntunssdeb18.042:3.35-2ubuntu2.8Not reportedUSN-4397-1Not reported
Ubuntunssdeb20.042:3.49.1-1ubuntu1.1Not reportedUSN-4397-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libnss3]Unknown

    Source package: [nss]

    Details (4)
    • 2:3.87.1-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · bookworm; dsa · nss · debian · 12

    • 2:3.87.1-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · bookworm; dsa · nss · debian · 12

    • 2:3.87.1-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · bookworm; dsa · nss · debian · 12

    • 2:3.87.1-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · bookworm; dsa · nss · debian · 12

  • [libnss3-dev]Unknown

    Source package: [nss]

    Details (4)
    • 2:3.87.1-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · bookworm; dsa · nss · debian · 12

    • 2:3.87.1-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · bookworm; dsa · nss · debian · 12

    • 2:3.87.1-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · bookworm; dsa · nss · debian · 12

    • 2:3.87.1-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · bookworm; dsa · nss · debian · 12

  • [libnss3-tools]Unknown

    Source package: [nss]

    Details (4)
    • 2:3.87.1-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · bookworm; dsa · nss · debian · 12

    • 2:3.87.1-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · bookworm; dsa · nss · debian · 12

    • 2:3.87.1-1+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · bookworm; dsa · nss · debian · 12

    • 2:3.87.1-1+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · bookworm; dsa · nss · debian · 12

[Debian 13 (Trixie)]

  • [libnss3]Unknown

    Source package: [nss]

    Details (4)
    • 2:3.110-1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · 13

    • 2:3.110-1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · 13

    • 2:3.110-1+deb13u4 · amd64 · trixie-security

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · 13

    • 2:3.110-1+deb13u4 · arm64 · trixie-security

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · 13

  • [libnss3-dev]Unknown

    Source package: [nss]

    Details (4)
    • 2:3.110-1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · 13

    • 2:3.110-1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · 13

    • 2:3.110-1+deb13u4 · amd64 · trixie-security

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · 13

    • 2:3.110-1+deb13u4 · arm64 · trixie-security

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · 13

  • [libnss3-tools]Unknown

    Source package: [nss]

    Details (4)
    • 2:3.110-1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · 13

    • 2:3.110-1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · 13

    • 2:3.110-1+deb13u4 · amd64 · trixie-security

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · 13

    • 2:3.110-1+deb13u4 · arm64 · trixie-security

      Fixed · Fixed: 2:3.49-1

      dsa · nss · debian · 13

Observed:

References