{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/debian10els/vex/2023/cve-2023-4421-els_os-debian10els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-08-03T13:44:21Z",
      "generator": {
        "date": "2026-08-03T13:44:20Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2023-4421-ELS_OS-DEBIAN10ELS",
      "initial_release_date": "2023-12-12T17:15:00Z",
      "revision_history": [
        {
          "date": "2023-12-12T17:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-31T18:30:36Z",
          "number": "2",
          "summary": "Official Publication"
        },
        {
          "date": "2026-08-03T13:44:21Z",
          "number": "3",
          "summary": "Update document"
        }
      ],
      "status": "final",
      "version": "3"
    },
    "title": "Security update on CVE-2023-4421"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Debian 10",
                "product": {
                  "name": "Debian 10",
                  "product_id": "Debian-10",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Debian"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnss3-tools-2:3.42.1-1+deb10u8.amd64",
                "product": {
                  "name": "libnss3-tools-2:3.42.1-1+deb10u8.amd64",
                  "product_id": "libnss3-tools-2:3.42.1-1+deb10u8.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/debian/libnss3-tools@2:3.42.1-1%2Bdeb10u8?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnss3-dev-2:3.42.1-1+deb10u8.amd64",
                "product": {
                  "name": "libnss3-dev-2:3.42.1-1+deb10u8.amd64",
                  "product_id": "libnss3-dev-2:3.42.1-1+deb10u8.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/debian/libnss3-dev@2:3.42.1-1%2Bdeb10u8?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnss3-2:3.42.1-1+deb10u8.amd64",
                "product": {
                  "name": "libnss3-2:3.42.1-1+deb10u8.amd64",
                  "product_id": "libnss3-2:3.42.1-1+deb10u8.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/debian/libnss3@2:3.42.1-1%2Bdeb10u8?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Software in the Public Interest, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libnss3-tools-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
                "product": {
                  "name": "libnss3-tools-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
                  "product_id": "libnss3-tools-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libnss3-tools@2:3.42.1-1%2Bdeb10u8%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnss3-dev-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
                "product": {
                  "name": "libnss3-dev-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
                  "product_id": "libnss3-dev-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libnss3-dev@2:3.42.1-1%2Bdeb10u8%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libnss3-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
                "product": {
                  "name": "libnss3-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
                  "product_id": "libnss3-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/libnss3@2:3.42.1-1%2Bdeb10u8%2Btuxcare.els1?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnss3-tools-2:3.42.1-1+deb10u8+tuxcare.els1.amd64 as a component of Debian 10",
          "product_id": "Debian-10:libnss3-tools-2:3.42.1-1+deb10u8+tuxcare.els1.amd64"
        },
        "product_reference": "libnss3-tools-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnss3-dev-2:3.42.1-1+deb10u8+tuxcare.els1.amd64 as a component of Debian 10",
          "product_id": "Debian-10:libnss3-dev-2:3.42.1-1+deb10u8+tuxcare.els1.amd64"
        },
        "product_reference": "libnss3-dev-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnss3-2:3.42.1-1+deb10u8+tuxcare.els1.amd64 as a component of Debian 10",
          "product_id": "Debian-10:libnss3-2:3.42.1-1+deb10u8+tuxcare.els1.amd64"
        },
        "product_reference": "libnss3-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnss3-tools-2:3.42.1-1+deb10u8.amd64 as a component of Debian 10",
          "product_id": "Debian-10:libnss3-tools-2:3.42.1-1+deb10u8.amd64"
        },
        "product_reference": "libnss3-tools-2:3.42.1-1+deb10u8.amd64",
        "relates_to_product_reference": "Debian-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnss3-dev-2:3.42.1-1+deb10u8.amd64 as a component of Debian 10",
          "product_id": "Debian-10:libnss3-dev-2:3.42.1-1+deb10u8.amd64"
        },
        "product_reference": "libnss3-dev-2:3.42.1-1+deb10u8.amd64",
        "relates_to_product_reference": "Debian-10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libnss3-2:3.42.1-1+deb10u8.amd64 as a component of Debian 10",
          "product_id": "Debian-10:libnss3-2:3.42.1-1+deb10u8.amd64"
        },
        "product_reference": "libnss3-2:3.42.1-1+deb10u8.amd64",
        "relates_to_product_reference": "Debian-10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-4421",
      "cwe": {
        "id": "CWE-203",
        "name": "Observable Discrepancy"
      },
      "notes": [
        {
          "category": "description",
          "text": "The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS < 3.61.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "Debian-10:libnss3-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
          "Debian-10:libnss3-2:3.42.1-1+deb10u8.amd64",
          "Debian-10:libnss3-dev-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
          "Debian-10:libnss3-dev-2:3.42.1-1+deb10u8.amd64",
          "Debian-10:libnss3-tools-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
          "Debian-10:libnss3-tools-2:3.42.1-1+deb10u8.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2023-4421"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=1651411",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1651411"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2023-53/",
          "url": "https://www.mozilla.org/security/advisories/mfsa2023-53/"
        },
        {
          "category": "external",
          "summary": "https://lists.debian.org/debian-lts-announce/2023/10/msg00039.html",
          "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00039.html"
        }
      ],
      "release_date": "2023-12-12T17:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-08-03T11:36:18.421079Z",
          "details": "This flaw only applies when NSS actually performs PKCS#1 v1.5 RSA decryption (e.g., TLS_RSA key exchange); TLS 1.3 and TLS 1.2 configurations that negotiate ECDHE_RSA never exercise this path, and systems not using NSS or running NSS 3.61 or newer are unaffected. Exploitation also demands a very large number of chosen‑ciphertext queries with precise timing measurements against a directly reachable endpoint, which is difficult to achieve reliably over typical enterprise networks and VM/cloud latency. Given these constraints and the deprecation of RSA key exchange in modern TLS, the practical risk to managed enterprise servers is low and this CVE can be safely deprioritized.",
          "product_ids": [
            "Debian-10:libnss3-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
            "Debian-10:libnss3-2:3.42.1-1+deb10u8.amd64",
            "Debian-10:libnss3-dev-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
            "Debian-10:libnss3-dev-2:3.42.1-1+deb10u8.amd64",
            "Debian-10:libnss3-tools-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
            "Debian-10:libnss3-tools-2:3.42.1-1+deb10u8.amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Debian-10:libnss3-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
            "Debian-10:libnss3-2:3.42.1-1+deb10u8.amd64",
            "Debian-10:libnss3-dev-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
            "Debian-10:libnss3-dev-2:3.42.1-1+deb10u8.amd64",
            "Debian-10:libnss3-tools-2:3.42.1-1+deb10u8+tuxcare.els1.amd64",
            "Debian-10:libnss3-tools-2:3.42.1-1+deb10u8.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}