Loading vulnerability…
Minerva side-channel private-key disclosure in NSS
CVE-2023-6135 is a side-channel vulnerability affecting multiple NIST elliptic curves implemented in Network Security Services (NSS). The affected implementations are susceptible to the Minerva attack, potentially allowing an attacker to recover a private key. Firefox versions earlier than 121 are affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could disclose a private cryptographic key used with an affected NSS NIST curve, compromising the confidentiality of that key.
If you can’t patch tonight, do this now.
Install the latest Mozilla security updates for Firefox, Firefox ESR, and Thunderbird. No separate workaround is specified.
Patch, then assume compromise.
Upgrade Firefox to version 121 or later. For affected Echo installations, update the NSS library and related packages to version 2:3.95-1 or later. Apply vendor-provided NSS security updates to other affected deployments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.