{"id":"CVE-2023-4421","state":"PUBLISHED","title":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length","description":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS < 3.61.","publishedAt":"2023-12-12T17:02:08.801Z","updatedAt":"2025-11-04T19:25:18.220Z","severity":null,"assigner":"mozilla","products":["Mozilla NSS"],"affected":[{"vendor":"Mozilla","product":"NSS","versions":[{"version":"unspecified","status":"affected","lessThan":"3.61","versionType":"custom"}]}],"references":["https://bugzilla.mozilla.org/show_bug.cgi?id=1651411","https://www.mozilla.org/security/advisories/mfsa2023-53/","https://lists.debian.org/debian-lts-announce/2023/10/msg00039.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/4xxx/CVE-2023-4421.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-4421","state":"PUBLISHED","datePublished":"2023-12-12T17:02:08.801Z","dateUpdated":"2025-11-04T19:25:18.220Z","assignerShortName":"mozilla","assignerOrgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","dateReserved":"2023-08-18T13:25:38.056Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS < 3.61."}],"affected":[{"vendor":"Mozilla","product":"NSS","versions":[{"version":"unspecified","status":"affected","lessThan":"3.61","versionType":"custom"}]}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1651411"},{"url":"https://www.mozilla.org/security/advisories/mfsa2023-53/"}],"problemTypes":[{"descriptions":[{"description":"Timing side-channel in PKCS#1 v1.5 decryption depadding code","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"mozilla","orgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","dateUpdated":"2023-12-12T17:02:08.801Z"},"credits":[{"lang":"en","value":"Hubert Kario"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1651411","tags":["x_transferred"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2023-53/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00039.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T19:25:18.220Z"}}]}}}