| Name | CVE-2023-5388 |
| Description | NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-3757-1, DLA-3769-1, DLA-3775-1, DSA-5643-1, DSA-5644-1 |
| Debian Bugs | 1056284 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| firefox (PTS) | sid | 138.0.3-1 | fixed |
| firefox-esr (PTS) | bullseye | 115.14.0esr-1~deb11u1 | fixed |
| bullseye (security) | 128.9.0esr-1~deb11u1 | fixed | |
| bookworm | 128.8.0esr-1~deb12u1 | fixed | |
| bookworm (security) | 128.10.0esr-1~deb12u1 | fixed | |
| sid, trixie | 128.10.0esr-1 | fixed | |
| nss (PTS) | bullseye | 2:3.61-1+deb11u3 | vulnerable |
| bullseye (security) | 2:3.61-1+deb11u4 | vulnerable | |
| bookworm, bookworm (security) | 2:3.87.1-1+deb12u1 | vulnerable | |
| sid, trixie | 2:3.110-1 | fixed | |
| thunderbird (PTS) | bullseye | 1:115.12.0-1~deb11u1 | fixed |
| bullseye (security) | 1:128.10.0esr-1~deb11u1 | fixed | |
| bookworm | 1:128.8.0esr-1~deb12u1 | fixed | |
| bookworm (security) | 1:128.10.0esr-1~deb12u1 | fixed | |
| sid, trixie | 1:128.10.0esr-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| firefox | source | (unstable) | 124.0-1 | |||
| firefox-esr | source | buster | 115.9.1esr-1~deb10u1 | DLA-3775-1 | ||
| firefox-esr | source | bullseye | 115.9.0esr-1~deb11u1 | DSA-5643-1 | ||
| firefox-esr | source | bookworm | 115.9.0esr-1~deb12u1 | DSA-5643-1 | ||
| firefox-esr | source | (unstable) | 115.9.0esr-1 | |||
| nss | source | buster | 2:3.42.1-1+deb10u8 | DLA-3757-1 | ||
| nss | source | (unstable) | 2:3.98-1 | 1056284 | ||
| thunderbird | source | buster | 1:115.9.0-1~deb10u1 | DLA-3769-1 | ||
| thunderbird | source | bullseye | 1:115.9.0-1~deb11u1 | DSA-5644-1 | ||
| thunderbird | source | bookworm | 1:115.9.0-1~deb12u1 | DSA-5644-1 | ||
| thunderbird | source | (unstable) | 1:115.9.0-1 |
[bookworm] - nss <ignored> (Minor issue, too intrusive to backport)
[bullseye] - nss <no-dsa> (Minor issue)
https://people.redhat.com/~hkario/marvin/
Vendor patch (Rocky Linux, not upstreamed): https://git.rockylinux.org/staging/rpms/nss/-/commit/1f7f7523b61a2ada2f461548c4160fbbf979c5dd
Fixed by: https://hg.mozilla.org/projects/nss/rev/196716d8377ab427e326f20bff2d026e90ac69e2
https://www.mozilla.org/en-US/security/advisories/mfsa2024-12/#CVE-2023-5388
https://www.mozilla.org/en-US/security/advisories/mfsa2024-13/#CVE-2023-5388
https://www.mozilla.org/en-US/security/advisories/mfsa2024-14/#CVE-2023-5388