var-201905-0799
Vulnerability from variot
A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41. NSS Contains a cryptographic vulnerability.Information may be obtained. Mozilla Network Security Services is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: nss, nss-softokn, nss-util, and nspr security, bug fix, and enhancement update Advisory ID: RHSA-2019:2237-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:2237 Issue date: 2019-08-06 CVE Names: CVE-2018-0495 CVE-2018-12404 ==================================================================== 1. Summary:
An update for nss, nss-softokn, nss-util, and nspr is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
- Description:
Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.
Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.
The following packages have been upgraded to a later upstream version: nss (3.44.0), nss-softokn (3.44.0), nss-util (3.44.0), nspr (4.21.0). (BZ#1645231, BZ#1692269, BZ#1692271, BZ#1692274)
Security Fix(es):
-
ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)
-
nss: Cache side-channel variant of the Bleichenbacher attack (CVE-2018-12404)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, applications using nss or nspr (for example, Firefox) must be restarted for this update to take effect.
- Bugs fixed (https://bugzilla.redhat.com/):
1144186 - Cannot delete orphan private keys with certutil.
1212132 - Support for IKE/IPsec typical PKIX usage so libreswan can use nss without rejecting certs based on EKU
1431241 - Fully implement verification of RSA-PSS keys in certificates in tstclnt and selfserv [rhel-7]
1444136 - move NSS signtool to the unsupported tools in RHEL 7.6
1455288 - TLS 1.3 handshake fails with SSL_REQUIRE_SAFE_NEGOTIATION on
1508571 - Exporting RSA-PSS keys to PKCS#12 drops the rsa-pss identifier from them [rhel-7]
1508595 - Regression in handling unknown signature algorithms extensions
1509045 - selfserv refuses to use rsa-pss keys [rhel-7]
1509396 - RFC 5246 non compliance with CertificateVerify fallback to SHA-1 [rhel-7]
1510156 - RSA PKCS#1 v1.5 signatures made using rsa-pss keys are accepted as valid [rhel-7]
1514041 - certutil -O output isn't precise when the input is an ambiguous nickname used by multiple certificates
1533729 - [RFE] certutil capability: generate CSR from orphan private key
1538081 - Policy does not apply to MGF1 hash in RSA-PSS signatures [rhel-7]
1591163 - CVE-2018-0495 ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries
1639873 - mod_nss - TLS Session ID is still not maintained (ref bz 1461580)
1657164 - certutil -u I
is not documented
1657913 - CVE-2018-12404 nss: Cache side-channel variant of the Bleichenbacher attack
1670239 - libpkix name constraints check treats CN as DNS name when it should not
1712876 - post handshake authentication with selfserv does not work if SSL_ENABLE_SESSION_TICKETS is set [rhel-7]
- Package List:
Red Hat Enterprise Linux Client (v. 7):
Source: nspr-4.21.0-1.el7.src.rpm nss-3.44.0-4.el7.src.rpm nss-softokn-3.44.0-5.el7.src.rpm nss-util-3.44.0-3.el7.src.rpm
x86_64: nspr-4.21.0-1.el7.i686.rpm nspr-4.21.0-1.el7.x86_64.rpm nspr-debuginfo-4.21.0-1.el7.i686.rpm nspr-debuginfo-4.21.0-1.el7.x86_64.rpm nss-3.44.0-4.el7.i686.rpm nss-3.44.0-4.el7.x86_64.rpm nss-debuginfo-3.44.0-4.el7.i686.rpm nss-debuginfo-3.44.0-4.el7.x86_64.rpm nss-softokn-3.44.0-5.el7.i686.rpm nss-softokn-3.44.0-5.el7.x86_64.rpm nss-softokn-debuginfo-3.44.0-5.el7.i686.rpm nss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm nss-softokn-freebl-3.44.0-5.el7.i686.rpm nss-softokn-freebl-3.44.0-5.el7.x86_64.rpm nss-sysinit-3.44.0-4.el7.x86_64.rpm nss-tools-3.44.0-4.el7.x86_64.rpm nss-util-3.44.0-3.el7.i686.rpm nss-util-3.44.0-3.el7.x86_64.rpm nss-util-debuginfo-3.44.0-3.el7.i686.rpm nss-util-debuginfo-3.44.0-3.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: nspr-debuginfo-4.21.0-1.el7.i686.rpm nspr-debuginfo-4.21.0-1.el7.x86_64.rpm nspr-devel-4.21.0-1.el7.i686.rpm nspr-devel-4.21.0-1.el7.x86_64.rpm nss-debuginfo-3.44.0-4.el7.i686.rpm nss-debuginfo-3.44.0-4.el7.x86_64.rpm nss-devel-3.44.0-4.el7.i686.rpm nss-devel-3.44.0-4.el7.x86_64.rpm nss-pkcs11-devel-3.44.0-4.el7.i686.rpm nss-pkcs11-devel-3.44.0-4.el7.x86_64.rpm nss-softokn-debuginfo-3.44.0-5.el7.i686.rpm nss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm nss-softokn-devel-3.44.0-5.el7.i686.rpm nss-softokn-devel-3.44.0-5.el7.x86_64.rpm nss-softokn-freebl-devel-3.44.0-5.el7.i686.rpm nss-softokn-freebl-devel-3.44.0-5.el7.x86_64.rpm nss-util-debuginfo-3.44.0-3.el7.i686.rpm nss-util-debuginfo-3.44.0-3.el7.x86_64.rpm nss-util-devel-3.44.0-3.el7.i686.rpm nss-util-devel-3.44.0-3.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: nspr-4.21.0-1.el7.src.rpm nss-3.44.0-4.el7.src.rpm nss-softokn-3.44.0-5.el7.src.rpm nss-util-3.44.0-3.el7.src.rpm
x86_64: nspr-4.21.0-1.el7.i686.rpm nspr-4.21.0-1.el7.x86_64.rpm nspr-debuginfo-4.21.0-1.el7.i686.rpm nspr-debuginfo-4.21.0-1.el7.x86_64.rpm nss-3.44.0-4.el7.i686.rpm nss-3.44.0-4.el7.x86_64.rpm nss-debuginfo-3.44.0-4.el7.i686.rpm nss-debuginfo-3.44.0-4.el7.x86_64.rpm nss-softokn-3.44.0-5.el7.i686.rpm nss-softokn-3.44.0-5.el7.x86_64.rpm nss-softokn-debuginfo-3.44.0-5.el7.i686.rpm nss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm nss-softokn-freebl-3.44.0-5.el7.i686.rpm nss-softokn-freebl-3.44.0-5.el7.x86_64.rpm nss-sysinit-3.44.0-4.el7.x86_64.rpm nss-tools-3.44.0-4.el7.x86_64.rpm nss-util-3.44.0-3.el7.i686.rpm nss-util-3.44.0-3.el7.x86_64.rpm nss-util-debuginfo-3.44.0-3.el7.i686.rpm nss-util-debuginfo-3.44.0-3.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64: nspr-debuginfo-4.21.0-1.el7.i686.rpm nspr-debuginfo-4.21.0-1.el7.x86_64.rpm nspr-devel-4.21.0-1.el7.i686.rpm nspr-devel-4.21.0-1.el7.x86_64.rpm nss-debuginfo-3.44.0-4.el7.i686.rpm nss-debuginfo-3.44.0-4.el7.x86_64.rpm nss-devel-3.44.0-4.el7.i686.rpm nss-devel-3.44.0-4.el7.x86_64.rpm nss-pkcs11-devel-3.44.0-4.el7.i686.rpm nss-pkcs11-devel-3.44.0-4.el7.x86_64.rpm nss-softokn-debuginfo-3.44.0-5.el7.i686.rpm nss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm nss-softokn-devel-3.44.0-5.el7.i686.rpm nss-softokn-devel-3.44.0-5.el7.x86_64.rpm nss-softokn-freebl-devel-3.44.0-5.el7.i686.rpm nss-softokn-freebl-devel-3.44.0-5.el7.x86_64.rpm nss-util-debuginfo-3.44.0-3.el7.i686.rpm nss-util-debuginfo-3.44.0-3.el7.x86_64.rpm nss-util-devel-3.44.0-3.el7.i686.rpm nss-util-devel-3.44.0-3.el7.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: nspr-4.21.0-1.el7.src.rpm nss-3.44.0-4.el7.src.rpm nss-softokn-3.44.0-5.el7.src.rpm nss-util-3.44.0-3.el7.src.rpm
ppc64: nspr-4.21.0-1.el7.ppc.rpm nspr-4.21.0-1.el7.ppc64.rpm nspr-debuginfo-4.21.0-1.el7.ppc.rpm nspr-debuginfo-4.21.0-1.el7.ppc64.rpm nspr-devel-4.21.0-1.el7.ppc.rpm nspr-devel-4.21.0-1.el7.ppc64.rpm nss-3.44.0-4.el7.ppc.rpm nss-3.44.0-4.el7.ppc64.rpm nss-debuginfo-3.44.0-4.el7.ppc.rpm nss-debuginfo-3.44.0-4.el7.ppc64.rpm nss-devel-3.44.0-4.el7.ppc.rpm nss-devel-3.44.0-4.el7.ppc64.rpm nss-softokn-3.44.0-5.el7.ppc.rpm nss-softokn-3.44.0-5.el7.ppc64.rpm nss-softokn-debuginfo-3.44.0-5.el7.ppc.rpm nss-softokn-debuginfo-3.44.0-5.el7.ppc64.rpm nss-softokn-devel-3.44.0-5.el7.ppc.rpm nss-softokn-devel-3.44.0-5.el7.ppc64.rpm nss-softokn-freebl-3.44.0-5.el7.ppc.rpm nss-softokn-freebl-3.44.0-5.el7.ppc64.rpm nss-softokn-freebl-devel-3.44.0-5.el7.ppc.rpm nss-softokn-freebl-devel-3.44.0-5.el7.ppc64.rpm nss-sysinit-3.44.0-4.el7.ppc64.rpm nss-tools-3.44.0-4.el7.ppc64.rpm nss-util-3.44.0-3.el7.ppc.rpm nss-util-3.44.0-3.el7.ppc64.rpm nss-util-debuginfo-3.44.0-3.el7.ppc.rpm nss-util-debuginfo-3.44.0-3.el7.ppc64.rpm nss-util-devel-3.44.0-3.el7.ppc.rpm nss-util-devel-3.44.0-3.el7.ppc64.rpm
ppc64le: nspr-4.21.0-1.el7.ppc64le.rpm nspr-debuginfo-4.21.0-1.el7.ppc64le.rpm nspr-devel-4.21.0-1.el7.ppc64le.rpm nss-3.44.0-4.el7.ppc64le.rpm nss-debuginfo-3.44.0-4.el7.ppc64le.rpm nss-devel-3.44.0-4.el7.ppc64le.rpm nss-softokn-3.44.0-5.el7.ppc64le.rpm nss-softokn-debuginfo-3.44.0-5.el7.ppc64le.rpm nss-softokn-devel-3.44.0-5.el7.ppc64le.rpm nss-softokn-freebl-3.44.0-5.el7.ppc64le.rpm nss-softokn-freebl-devel-3.44.0-5.el7.ppc64le.rpm nss-sysinit-3.44.0-4.el7.ppc64le.rpm nss-tools-3.44.0-4.el7.ppc64le.rpm nss-util-3.44.0-3.el7.ppc64le.rpm nss-util-debuginfo-3.44.0-3.el7.ppc64le.rpm nss-util-devel-3.44.0-3.el7.ppc64le.rpm
s390x: nspr-4.21.0-1.el7.s390.rpm nspr-4.21.0-1.el7.s390x.rpm nspr-debuginfo-4.21.0-1.el7.s390.rpm nspr-debuginfo-4.21.0-1.el7.s390x.rpm nspr-devel-4.21.0-1.el7.s390.rpm nspr-devel-4.21.0-1.el7.s390x.rpm nss-3.44.0-4.el7.s390.rpm nss-3.44.0-4.el7.s390x.rpm nss-debuginfo-3.44.0-4.el7.s390.rpm nss-debuginfo-3.44.0-4.el7.s390x.rpm nss-devel-3.44.0-4.el7.s390.rpm nss-devel-3.44.0-4.el7.s390x.rpm nss-softokn-3.44.0-5.el7.s390.rpm nss-softokn-3.44.0-5.el7.s390x.rpm nss-softokn-debuginfo-3.44.0-5.el7.s390.rpm nss-softokn-debuginfo-3.44.0-5.el7.s390x.rpm nss-softokn-devel-3.44.0-5.el7.s390.rpm nss-softokn-devel-3.44.0-5.el7.s390x.rpm nss-softokn-freebl-3.44.0-5.el7.s390.rpm nss-softokn-freebl-3.44.0-5.el7.s390x.rpm nss-softokn-freebl-devel-3.44.0-5.el7.s390.rpm nss-softokn-freebl-devel-3.44.0-5.el7.s390x.rpm nss-sysinit-3.44.0-4.el7.s390x.rpm nss-tools-3.44.0-4.el7.s390x.rpm nss-util-3.44.0-3.el7.s390.rpm nss-util-3.44.0-3.el7.s390x.rpm nss-util-debuginfo-3.44.0-3.el7.s390.rpm nss-util-debuginfo-3.44.0-3.el7.s390x.rpm nss-util-devel-3.44.0-3.el7.s390.rpm nss-util-devel-3.44.0-3.el7.s390x.rpm
x86_64: nspr-4.21.0-1.el7.i686.rpm nspr-4.21.0-1.el7.x86_64.rpm nspr-debuginfo-4.21.0-1.el7.i686.rpm nspr-debuginfo-4.21.0-1.el7.x86_64.rpm nspr-devel-4.21.0-1.el7.i686.rpm nspr-devel-4.21.0-1.el7.x86_64.rpm nss-3.44.0-4.el7.i686.rpm nss-3.44.0-4.el7.x86_64.rpm nss-debuginfo-3.44.0-4.el7.i686.rpm nss-debuginfo-3.44.0-4.el7.x86_64.rpm nss-devel-3.44.0-4.el7.i686.rpm nss-devel-3.44.0-4.el7.x86_64.rpm nss-softokn-3.44.0-5.el7.i686.rpm nss-softokn-3.44.0-5.el7.x86_64.rpm nss-softokn-debuginfo-3.44.0-5.el7.i686.rpm nss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm nss-softokn-devel-3.44.0-5.el7.i686.rpm nss-softokn-devel-3.44.0-5.el7.x86_64.rpm nss-softokn-freebl-3.44.0-5.el7.i686.rpm nss-softokn-freebl-3.44.0-5.el7.x86_64.rpm nss-softokn-freebl-devel-3.44.0-5.el7.i686.rpm nss-softokn-freebl-devel-3.44.0-5.el7.x86_64.rpm nss-sysinit-3.44.0-4.el7.x86_64.rpm nss-tools-3.44.0-4.el7.x86_64.rpm nss-util-3.44.0-3.el7.i686.rpm nss-util-3.44.0-3.el7.x86_64.rpm nss-util-debuginfo-3.44.0-3.el7.i686.rpm nss-util-debuginfo-3.44.0-3.el7.x86_64.rpm nss-util-devel-3.44.0-3.el7.i686.rpm nss-util-devel-3.44.0-3.el7.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64: nss-debuginfo-3.44.0-4.el7.ppc.rpm nss-debuginfo-3.44.0-4.el7.ppc64.rpm nss-pkcs11-devel-3.44.0-4.el7.ppc.rpm nss-pkcs11-devel-3.44.0-4.el7.ppc64.rpm
ppc64le: nss-debuginfo-3.44.0-4.el7.ppc64le.rpm nss-pkcs11-devel-3.44.0-4.el7.ppc64le.rpm
s390x: nss-debuginfo-3.44.0-4.el7.s390.rpm nss-debuginfo-3.44.0-4.el7.s390x.rpm nss-pkcs11-devel-3.44.0-4.el7.s390.rpm nss-pkcs11-devel-3.44.0-4.el7.s390x.rpm
x86_64: nss-debuginfo-3.44.0-4.el7.i686.rpm nss-debuginfo-3.44.0-4.el7.x86_64.rpm nss-pkcs11-devel-3.44.0-4.el7.i686.rpm nss-pkcs11-devel-3.44.0-4.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source: nspr-4.21.0-1.el7.src.rpm nss-3.44.0-4.el7.src.rpm nss-softokn-3.44.0-5.el7.src.rpm nss-util-3.44.0-3.el7.src.rpm
x86_64: nspr-4.21.0-1.el7.i686.rpm nspr-4.21.0-1.el7.x86_64.rpm nspr-debuginfo-4.21.0-1.el7.i686.rpm nspr-debuginfo-4.21.0-1.el7.x86_64.rpm nspr-devel-4.21.0-1.el7.i686.rpm nspr-devel-4.21.0-1.el7.x86_64.rpm nss-3.44.0-4.el7.i686.rpm nss-3.44.0-4.el7.x86_64.rpm nss-debuginfo-3.44.0-4.el7.i686.rpm nss-debuginfo-3.44.0-4.el7.x86_64.rpm nss-devel-3.44.0-4.el7.i686.rpm nss-devel-3.44.0-4.el7.x86_64.rpm nss-softokn-3.44.0-5.el7.i686.rpm nss-softokn-3.44.0-5.el7.x86_64.rpm nss-softokn-debuginfo-3.44.0-5.el7.i686.rpm nss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm nss-softokn-devel-3.44.0-5.el7.i686.rpm nss-softokn-devel-3.44.0-5.el7.x86_64.rpm nss-softokn-freebl-3.44.0-5.el7.i686.rpm nss-softokn-freebl-3.44.0-5.el7.x86_64.rpm nss-softokn-freebl-devel-3.44.0-5.el7.i686.rpm nss-softokn-freebl-devel-3.44.0-5.el7.x86_64.rpm nss-sysinit-3.44.0-4.el7.x86_64.rpm nss-tools-3.44.0-4.el7.x86_64.rpm nss-util-3.44.0-3.el7.i686.rpm nss-util-3.44.0-3.el7.x86_64.rpm nss-util-debuginfo-3.44.0-3.el7.i686.rpm nss-util-debuginfo-3.44.0-3.el7.x86_64.rpm nss-util-devel-3.44.0-3.el7.i686.rpm nss-util-devel-3.44.0-3.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64: nss-debuginfo-3.44.0-4.el7.i686.rpm nss-debuginfo-3.44.0-4.el7.x86_64.rpm nss-pkcs11-devel-3.44.0-4.el7.i686.rpm nss-pkcs11-devel-3.44.0-4.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2018-0495 https://access.redhat.com/security/cve/CVE-2018-12404 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBXUl2i9zjgjWX9erEAQgsZg//RYLUdEWlARE9jDIOZakUKoDGisG1+EU8 JJeTAGqksGTHEAgRpfOsYcM/uIuMXfBJmE1Gr6++KQteUhIT1aKTqbf3sdSM0fPo 97CYjcRXejluoO45Kmw7C4o9NN2MAeoEpykFQJyqM0gLIOu+thhMzViFUEEDf5YA jhOrkRw/xLJPhXkiUFcjBywMNsqi4TEHBKU3e+YgAUSBe2p6LaEbGJGnoFMBiskM 1mNqCmQHs0Q7yPE8F3wOXIve+CeZvvJlJQ10a9YLSM6tkUuf6KwqSEC0F8vLOnSF 6gpZZKXJgc70sTCJ0Eym82CHQD6kdzUBhN071P+wRX66fYai7CnbnuY77o2HVRRr gT0QbDrlhldxZ0DLbu81DjgmheYUhv5alY6MR/M5BcBU+MNokEgH7a00go6cbfKE q0kJCTpJpQN4y6t+0Tb6alXYdGLvae9QW85TxWzkYlV2uUxZEegkX07AI9XFpeCN Yr8PjJuMy2HbrB+OAFb/gSm2kC/v37mpIxVQr4HCWcqheKIOsoF/pBELrTJe9ON4 ZLZftXKCLD/Lwb55uDzJHBhSkhCOyBCwNMj2j261keB+X8EuxI8UcnmGR87xTHnd QaZUxlEVzc2ZfCFl2LttiT+v0F1FlbmKkqLlXh7DU5Z05f4evtmQ9D17aQzRNDHL wSLYXpOCaSY&NJ -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce .
Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/mozilla-nss-3.40.1-i586-1_slack14.2.txz: Upgraded. Upgraded to nss-3.40.1 and nspr-4.20. Mitigate cache side-channel variant of the Bleichenbacher attack. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404 ( Security fix ) +--------------------------+
Where to find the new packages: +-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you.
Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/mozilla-nss-3.23-i486-1_slack14.0.txz
Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/mozilla-nss-3.23-x86_64-1_slack14.0.txz
Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mozilla-nss-3.40.1-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mozilla-nss-3.40.1-x86_64-1_slack14.1.txz
Updated package for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/mozilla-nss-3.40.1-i586-1_slack14.2.txz
Updated package for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/mozilla-nss-3.40.1-x86_64-1_slack14.2.txz
Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/mozilla-nss-3.40.1-i586-1.txz
Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/mozilla-nss-3.40.1-x86_64-1.txz
MD5 signatures: +-------------+
Slackware 14.0 package: 477aad77295cdad06550ec789db125ed mozilla-nss-3.23-i486-1_slack14.0.txz
Slackware x86_64 14.0 package: da2b0d54d5bab3d60766691fefbfe59e mozilla-nss-3.23-x86_64-1_slack14.0.txz
Slackware 14.1 package: 2b87e41ebe92bb411f9ba6c7b3dc90a3 mozilla-nss-3.40.1-i486-1_slack14.1.txz
Slackware x86_64 14.1 package: 97f5628b15deea966d2e3a53cbf63e41 mozilla-nss-3.40.1-x86_64-1_slack14.1.txz
Slackware 14.2 package: 6d3340c45970475bc3aa8329f82c8f1c mozilla-nss-3.40.1-i586-1_slack14.2.txz
Slackware x86_64 14.2 package: 0b07bd47fca120a143111804aa70bdd3 mozilla-nss-3.40.1-x86_64-1_slack14.2.txz
Slackware -current package: 3b130c0c68b8283c5e243a5a23cfa368 l/mozilla-nss-3.40.1-i586-1.txz
Slackware x86_64 -current package: 7191a0d1e6d618e89a0e5014bde3f29e l/mozilla-nss-3.40.1-x86_64-1.txz
Installation instructions: +------------------------+
Upgrade the package as root:
upgradepkg mozilla-nss-3.40.1-i586-1_slack14.2.txz
+-----+
Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com
+------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. ========================================================================== Ubuntu Security Notice USN-3850-2 February 18, 2019
nss vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in NSS. This update provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perform a cache-timing attack and recover private ECDSA keys. (CVE-2018-0495)
It was discovered that NSS incorrectly handled certain v2-compatible ClientHello messages. A remote attacker could possibly use this issue to perform a replay attack. (CVE-2018-12384)
It was discovered that NSS incorrectly handled certain padding oracles. A remote attacker could possibly use this issue to perform a variant of the Bleichenbacher attack
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201905-0799", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "network security services", "scope": "lt", "trust": 1.8, "vendor": "mozilla", "version": "3.41" }, { "model": "linux", "scope": "eq", "trust": 0.3, "vendor": "ubuntu", "version": "18.10" }, { "model": "linux lts", "scope": "eq", "trust": 0.3, "vendor": "ubuntu", "version": "18.04" }, { "model": "linux lts", "scope": "eq", "trust": 0.3, "vendor": "ubuntu", "version": "16.04" }, { "model": "linux lts", "scope": "eq", "trust": 0.3, "vendor": "ubuntu", "version": "14.04" }, { "model": "linux esm", "scope": "eq", "trust": 0.3, "vendor": "ubuntu", "version": "12.04" }, { "model": "virtualization", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "4" }, { "model": "enterprise linux", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "7" }, { "model": "enterprise linux", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "6" }, { "model": "enterprise linux", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "5" }, { "model": "communications messaging server", "scope": "eq", "trust": 0.3, "vendor": "oracle", "version": "8.1" }, { "model": "communications messaging server", "scope": "eq", "trust": 0.3, "vendor": "oracle", "version": "8.0" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.36.5" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.36.4" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.36.3" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.36.2" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.36.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.34.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.31.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.30.2" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.30.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.29.5" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.29.4" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.29.3" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.29.2" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.29.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.28.4" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.28" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.21.4" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.21.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.20.2" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.20.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.19.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.17.3" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.17.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.15.4" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.15.3" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.15.2" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.15.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.14.5" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.14.4" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.10" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.8" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.5" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.4" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.3" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.2" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.11.3" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.9.2" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.9" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.8" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.7.7" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.7.5" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.7.3" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.7.2" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.7.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.7" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.6.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.6" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.5" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.3.2" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.3.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.3" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.2.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.2" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.40" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.36" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.35" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.34" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.33" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.32" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.31" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.30" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.29" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.24.0" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.23" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.21" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.20" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.19.2.3" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.17" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.16.5" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.16.2.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.16" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.15.5" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.15.3.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.15" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.14.3" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.14.2" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.14.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.14" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.13.4" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.13.3" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.9" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.7" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.6" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.3.2" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.3.1" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12.11" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.12" }, { "model": "network security services", "scope": "eq", "trust": 0.3, "vendor": "mozilla", "version": "3.11" }, { "model": "traffix sdc", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "5.1" }, { "model": "traffix sdc", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "5.0" }, { "model": "traffix sdc", "scope": "eq", "trust": 0.3, "vendor": "f5", "version": "4.4" }, { "model": "network security services", "scope": "ne", "trust": 0.3, "vendor": "mozilla", "version": "3.40.1" }, { "model": "network security services", "scope": "ne", "trust": 0.3, "vendor": "mozilla", "version": "3.36.6" } ], "sources": [ { "db": "BID", "id": "107260" }, { "db": "JVNDB", "id": "JVNDB-2018-015300" }, { "db": "NVD", "id": "CVE-2018-12404" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "3.41", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2018-12404" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Ubuntu", "sources": [ { "db": "PACKETSTORM", "id": "151073" }, { "db": "PACKETSTORM", "id": "151740" }, { "db": "CNNVD", "id": "CNNVD-201812-201" } ], "trust": 0.8 }, "cve": "CVE-2018-12404", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "impactScore": 2.9, "integrityImpact": "NONE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "None", "baseScore": 4.3, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "CVE-2018-12404", "impactScore": null, "integrityImpact": "None", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "HIGH", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.2, "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, { "attackComplexity": "High", "attackVector": "Network", "author": "NVD", "availabilityImpact": "None", "baseScore": 5.9, "baseSeverity": "Medium", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2018-12404", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2018-12404", "trust": 1.8, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201812-201", "trust": 0.6, "value": "MEDIUM" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-015300" }, { "db": "NVD", "id": "CVE-2018-12404" }, { "db": "CNNVD", "id": "CNNVD-201812-201" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41. NSS Contains a cryptographic vulnerability.Information may be obtained. Mozilla Network Security Services is prone to an information-disclosure vulnerability. \nAttackers can exploit this issue to obtain sensitive information that may aid in further attacks. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Moderate: nss, nss-softokn, nss-util, and nspr security, bug fix, and enhancement update\nAdvisory ID: RHSA-2019:2237-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://access.redhat.com/errata/RHSA-2019:2237\nIssue date: 2019-08-06\nCVE Names: CVE-2018-0495 CVE-2018-12404\n====================================================================\n1. Summary:\n\nAn update for nss, nss-softokn, nss-util, and nspr is now available for Red\nHat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - x86_64\nRed Hat Enterprise Linux Client Optional (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64\nRed Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 7) - x86_64\n\n3. Description:\n\nNetwork Security Services (NSS) is a set of libraries designed to support\nthe cross-platform development of security-enabled client and server\napplications. \n\nNetscape Portable Runtime (NSPR) provides platform independence for non-GUI\noperating system facilities. \n\nThe following packages have been upgraded to a later upstream version: nss\n(3.44.0), nss-softokn (3.44.0), nss-util (3.44.0), nspr (4.21.0). \n(BZ#1645231, BZ#1692269, BZ#1692271, BZ#1692274)\n\nSecurity Fix(es):\n\n* ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries\n(CVE-2018-0495)\n\n* nss: Cache side-channel variant of the Bleichenbacher attack\n(CVE-2018-12404)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 7.7 Release Notes linked from the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing this update, applications using nss or nspr (for example,\nFirefox) must be restarted for this update to take effect. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1144186 - Cannot delete orphan private keys with certutil. \n1212132 - Support for IKE/IPsec typical PKIX usage so libreswan can use nss without rejecting certs based on EKU\n1431241 - Fully implement verification of RSA-PSS keys in certificates in tstclnt and selfserv [rhel-7]\n1444136 - move NSS signtool to the unsupported tools in RHEL 7.6\n1455288 - TLS 1.3 handshake fails with SSL_REQUIRE_SAFE_NEGOTIATION on\n1508571 - Exporting RSA-PSS keys to PKCS#12 drops the rsa-pss identifier from them [rhel-7]\n1508595 - Regression in handling unknown signature algorithms extensions\n1509045 - selfserv refuses to use rsa-pss keys [rhel-7]\n1509396 - RFC 5246 non compliance with CertificateVerify fallback to SHA-1 [rhel-7]\n1510156 - RSA PKCS#1 v1.5 signatures made using rsa-pss keys are accepted as valid [rhel-7]\n1514041 - certutil -O output isn\u0027t precise when the input is an ambiguous nickname used by multiple certificates\n1533729 - [RFE] certutil capability: generate CSR from orphan private key\n1538081 - Policy does not apply to MGF1 hash in RSA-PSS signatures [rhel-7]\n1591163 - CVE-2018-0495 ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries\n1639873 - mod_nss - TLS Session ID is still not maintained (ref bz 1461580)\n1657164 - `certutil -u I` is not documented\n1657913 - CVE-2018-12404 nss: Cache side-channel variant of the Bleichenbacher attack\n1670239 - libpkix name constraints check treats CN as DNS name when it should not\n1712876 - post handshake authentication with selfserv does not work if SSL_ENABLE_SESSION_TICKETS is set [rhel-7]\n\n6. Package List:\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\nnspr-4.21.0-1.el7.src.rpm\nnss-3.44.0-4.el7.src.rpm\nnss-softokn-3.44.0-5.el7.src.rpm\nnss-util-3.44.0-3.el7.src.rpm\n\nx86_64:\nnspr-4.21.0-1.el7.i686.rpm\nnspr-4.21.0-1.el7.x86_64.rpm\nnspr-debuginfo-4.21.0-1.el7.i686.rpm\nnspr-debuginfo-4.21.0-1.el7.x86_64.rpm\nnss-3.44.0-4.el7.i686.rpm\nnss-3.44.0-4.el7.x86_64.rpm\nnss-debuginfo-3.44.0-4.el7.i686.rpm\nnss-debuginfo-3.44.0-4.el7.x86_64.rpm\nnss-softokn-3.44.0-5.el7.i686.rpm\nnss-softokn-3.44.0-5.el7.x86_64.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.i686.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm\nnss-softokn-freebl-3.44.0-5.el7.i686.rpm\nnss-softokn-freebl-3.44.0-5.el7.x86_64.rpm\nnss-sysinit-3.44.0-4.el7.x86_64.rpm\nnss-tools-3.44.0-4.el7.x86_64.rpm\nnss-util-3.44.0-3.el7.i686.rpm\nnss-util-3.44.0-3.el7.x86_64.rpm\nnss-util-debuginfo-3.44.0-3.el7.i686.rpm\nnss-util-debuginfo-3.44.0-3.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nx86_64:\nnspr-debuginfo-4.21.0-1.el7.i686.rpm\nnspr-debuginfo-4.21.0-1.el7.x86_64.rpm\nnspr-devel-4.21.0-1.el7.i686.rpm\nnspr-devel-4.21.0-1.el7.x86_64.rpm\nnss-debuginfo-3.44.0-4.el7.i686.rpm\nnss-debuginfo-3.44.0-4.el7.x86_64.rpm\nnss-devel-3.44.0-4.el7.i686.rpm\nnss-devel-3.44.0-4.el7.x86_64.rpm\nnss-pkcs11-devel-3.44.0-4.el7.i686.rpm\nnss-pkcs11-devel-3.44.0-4.el7.x86_64.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.i686.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm\nnss-softokn-devel-3.44.0-5.el7.i686.rpm\nnss-softokn-devel-3.44.0-5.el7.x86_64.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.i686.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.x86_64.rpm\nnss-util-debuginfo-3.44.0-3.el7.i686.rpm\nnss-util-debuginfo-3.44.0-3.el7.x86_64.rpm\nnss-util-devel-3.44.0-3.el7.i686.rpm\nnss-util-devel-3.44.0-3.el7.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\nnspr-4.21.0-1.el7.src.rpm\nnss-3.44.0-4.el7.src.rpm\nnss-softokn-3.44.0-5.el7.src.rpm\nnss-util-3.44.0-3.el7.src.rpm\n\nx86_64:\nnspr-4.21.0-1.el7.i686.rpm\nnspr-4.21.0-1.el7.x86_64.rpm\nnspr-debuginfo-4.21.0-1.el7.i686.rpm\nnspr-debuginfo-4.21.0-1.el7.x86_64.rpm\nnss-3.44.0-4.el7.i686.rpm\nnss-3.44.0-4.el7.x86_64.rpm\nnss-debuginfo-3.44.0-4.el7.i686.rpm\nnss-debuginfo-3.44.0-4.el7.x86_64.rpm\nnss-softokn-3.44.0-5.el7.i686.rpm\nnss-softokn-3.44.0-5.el7.x86_64.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.i686.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm\nnss-softokn-freebl-3.44.0-5.el7.i686.rpm\nnss-softokn-freebl-3.44.0-5.el7.x86_64.rpm\nnss-sysinit-3.44.0-4.el7.x86_64.rpm\nnss-tools-3.44.0-4.el7.x86_64.rpm\nnss-util-3.44.0-3.el7.i686.rpm\nnss-util-3.44.0-3.el7.x86_64.rpm\nnss-util-debuginfo-3.44.0-3.el7.i686.rpm\nnss-util-debuginfo-3.44.0-3.el7.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional (v. 7):\n\nx86_64:\nnspr-debuginfo-4.21.0-1.el7.i686.rpm\nnspr-debuginfo-4.21.0-1.el7.x86_64.rpm\nnspr-devel-4.21.0-1.el7.i686.rpm\nnspr-devel-4.21.0-1.el7.x86_64.rpm\nnss-debuginfo-3.44.0-4.el7.i686.rpm\nnss-debuginfo-3.44.0-4.el7.x86_64.rpm\nnss-devel-3.44.0-4.el7.i686.rpm\nnss-devel-3.44.0-4.el7.x86_64.rpm\nnss-pkcs11-devel-3.44.0-4.el7.i686.rpm\nnss-pkcs11-devel-3.44.0-4.el7.x86_64.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.i686.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm\nnss-softokn-devel-3.44.0-5.el7.i686.rpm\nnss-softokn-devel-3.44.0-5.el7.x86_64.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.i686.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.x86_64.rpm\nnss-util-debuginfo-3.44.0-3.el7.i686.rpm\nnss-util-debuginfo-3.44.0-3.el7.x86_64.rpm\nnss-util-devel-3.44.0-3.el7.i686.rpm\nnss-util-devel-3.44.0-3.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nnspr-4.21.0-1.el7.src.rpm\nnss-3.44.0-4.el7.src.rpm\nnss-softokn-3.44.0-5.el7.src.rpm\nnss-util-3.44.0-3.el7.src.rpm\n\nppc64:\nnspr-4.21.0-1.el7.ppc.rpm\nnspr-4.21.0-1.el7.ppc64.rpm\nnspr-debuginfo-4.21.0-1.el7.ppc.rpm\nnspr-debuginfo-4.21.0-1.el7.ppc64.rpm\nnspr-devel-4.21.0-1.el7.ppc.rpm\nnspr-devel-4.21.0-1.el7.ppc64.rpm\nnss-3.44.0-4.el7.ppc.rpm\nnss-3.44.0-4.el7.ppc64.rpm\nnss-debuginfo-3.44.0-4.el7.ppc.rpm\nnss-debuginfo-3.44.0-4.el7.ppc64.rpm\nnss-devel-3.44.0-4.el7.ppc.rpm\nnss-devel-3.44.0-4.el7.ppc64.rpm\nnss-softokn-3.44.0-5.el7.ppc.rpm\nnss-softokn-3.44.0-5.el7.ppc64.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.ppc.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.ppc64.rpm\nnss-softokn-devel-3.44.0-5.el7.ppc.rpm\nnss-softokn-devel-3.44.0-5.el7.ppc64.rpm\nnss-softokn-freebl-3.44.0-5.el7.ppc.rpm\nnss-softokn-freebl-3.44.0-5.el7.ppc64.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.ppc.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.ppc64.rpm\nnss-sysinit-3.44.0-4.el7.ppc64.rpm\nnss-tools-3.44.0-4.el7.ppc64.rpm\nnss-util-3.44.0-3.el7.ppc.rpm\nnss-util-3.44.0-3.el7.ppc64.rpm\nnss-util-debuginfo-3.44.0-3.el7.ppc.rpm\nnss-util-debuginfo-3.44.0-3.el7.ppc64.rpm\nnss-util-devel-3.44.0-3.el7.ppc.rpm\nnss-util-devel-3.44.0-3.el7.ppc64.rpm\n\nppc64le:\nnspr-4.21.0-1.el7.ppc64le.rpm\nnspr-debuginfo-4.21.0-1.el7.ppc64le.rpm\nnspr-devel-4.21.0-1.el7.ppc64le.rpm\nnss-3.44.0-4.el7.ppc64le.rpm\nnss-debuginfo-3.44.0-4.el7.ppc64le.rpm\nnss-devel-3.44.0-4.el7.ppc64le.rpm\nnss-softokn-3.44.0-5.el7.ppc64le.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.ppc64le.rpm\nnss-softokn-devel-3.44.0-5.el7.ppc64le.rpm\nnss-softokn-freebl-3.44.0-5.el7.ppc64le.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.ppc64le.rpm\nnss-sysinit-3.44.0-4.el7.ppc64le.rpm\nnss-tools-3.44.0-4.el7.ppc64le.rpm\nnss-util-3.44.0-3.el7.ppc64le.rpm\nnss-util-debuginfo-3.44.0-3.el7.ppc64le.rpm\nnss-util-devel-3.44.0-3.el7.ppc64le.rpm\n\ns390x:\nnspr-4.21.0-1.el7.s390.rpm\nnspr-4.21.0-1.el7.s390x.rpm\nnspr-debuginfo-4.21.0-1.el7.s390.rpm\nnspr-debuginfo-4.21.0-1.el7.s390x.rpm\nnspr-devel-4.21.0-1.el7.s390.rpm\nnspr-devel-4.21.0-1.el7.s390x.rpm\nnss-3.44.0-4.el7.s390.rpm\nnss-3.44.0-4.el7.s390x.rpm\nnss-debuginfo-3.44.0-4.el7.s390.rpm\nnss-debuginfo-3.44.0-4.el7.s390x.rpm\nnss-devel-3.44.0-4.el7.s390.rpm\nnss-devel-3.44.0-4.el7.s390x.rpm\nnss-softokn-3.44.0-5.el7.s390.rpm\nnss-softokn-3.44.0-5.el7.s390x.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.s390.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.s390x.rpm\nnss-softokn-devel-3.44.0-5.el7.s390.rpm\nnss-softokn-devel-3.44.0-5.el7.s390x.rpm\nnss-softokn-freebl-3.44.0-5.el7.s390.rpm\nnss-softokn-freebl-3.44.0-5.el7.s390x.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.s390.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.s390x.rpm\nnss-sysinit-3.44.0-4.el7.s390x.rpm\nnss-tools-3.44.0-4.el7.s390x.rpm\nnss-util-3.44.0-3.el7.s390.rpm\nnss-util-3.44.0-3.el7.s390x.rpm\nnss-util-debuginfo-3.44.0-3.el7.s390.rpm\nnss-util-debuginfo-3.44.0-3.el7.s390x.rpm\nnss-util-devel-3.44.0-3.el7.s390.rpm\nnss-util-devel-3.44.0-3.el7.s390x.rpm\n\nx86_64:\nnspr-4.21.0-1.el7.i686.rpm\nnspr-4.21.0-1.el7.x86_64.rpm\nnspr-debuginfo-4.21.0-1.el7.i686.rpm\nnspr-debuginfo-4.21.0-1.el7.x86_64.rpm\nnspr-devel-4.21.0-1.el7.i686.rpm\nnspr-devel-4.21.0-1.el7.x86_64.rpm\nnss-3.44.0-4.el7.i686.rpm\nnss-3.44.0-4.el7.x86_64.rpm\nnss-debuginfo-3.44.0-4.el7.i686.rpm\nnss-debuginfo-3.44.0-4.el7.x86_64.rpm\nnss-devel-3.44.0-4.el7.i686.rpm\nnss-devel-3.44.0-4.el7.x86_64.rpm\nnss-softokn-3.44.0-5.el7.i686.rpm\nnss-softokn-3.44.0-5.el7.x86_64.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.i686.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm\nnss-softokn-devel-3.44.0-5.el7.i686.rpm\nnss-softokn-devel-3.44.0-5.el7.x86_64.rpm\nnss-softokn-freebl-3.44.0-5.el7.i686.rpm\nnss-softokn-freebl-3.44.0-5.el7.x86_64.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.i686.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.x86_64.rpm\nnss-sysinit-3.44.0-4.el7.x86_64.rpm\nnss-tools-3.44.0-4.el7.x86_64.rpm\nnss-util-3.44.0-3.el7.i686.rpm\nnss-util-3.44.0-3.el7.x86_64.rpm\nnss-util-debuginfo-3.44.0-3.el7.i686.rpm\nnss-util-debuginfo-3.44.0-3.el7.x86_64.rpm\nnss-util-devel-3.44.0-3.el7.i686.rpm\nnss-util-devel-3.44.0-3.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\nppc64:\nnss-debuginfo-3.44.0-4.el7.ppc.rpm\nnss-debuginfo-3.44.0-4.el7.ppc64.rpm\nnss-pkcs11-devel-3.44.0-4.el7.ppc.rpm\nnss-pkcs11-devel-3.44.0-4.el7.ppc64.rpm\n\nppc64le:\nnss-debuginfo-3.44.0-4.el7.ppc64le.rpm\nnss-pkcs11-devel-3.44.0-4.el7.ppc64le.rpm\n\ns390x:\nnss-debuginfo-3.44.0-4.el7.s390.rpm\nnss-debuginfo-3.44.0-4.el7.s390x.rpm\nnss-pkcs11-devel-3.44.0-4.el7.s390.rpm\nnss-pkcs11-devel-3.44.0-4.el7.s390x.rpm\n\nx86_64:\nnss-debuginfo-3.44.0-4.el7.i686.rpm\nnss-debuginfo-3.44.0-4.el7.x86_64.rpm\nnss-pkcs11-devel-3.44.0-4.el7.i686.rpm\nnss-pkcs11-devel-3.44.0-4.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nnspr-4.21.0-1.el7.src.rpm\nnss-3.44.0-4.el7.src.rpm\nnss-softokn-3.44.0-5.el7.src.rpm\nnss-util-3.44.0-3.el7.src.rpm\n\nx86_64:\nnspr-4.21.0-1.el7.i686.rpm\nnspr-4.21.0-1.el7.x86_64.rpm\nnspr-debuginfo-4.21.0-1.el7.i686.rpm\nnspr-debuginfo-4.21.0-1.el7.x86_64.rpm\nnspr-devel-4.21.0-1.el7.i686.rpm\nnspr-devel-4.21.0-1.el7.x86_64.rpm\nnss-3.44.0-4.el7.i686.rpm\nnss-3.44.0-4.el7.x86_64.rpm\nnss-debuginfo-3.44.0-4.el7.i686.rpm\nnss-debuginfo-3.44.0-4.el7.x86_64.rpm\nnss-devel-3.44.0-4.el7.i686.rpm\nnss-devel-3.44.0-4.el7.x86_64.rpm\nnss-softokn-3.44.0-5.el7.i686.rpm\nnss-softokn-3.44.0-5.el7.x86_64.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.i686.rpm\nnss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm\nnss-softokn-devel-3.44.0-5.el7.i686.rpm\nnss-softokn-devel-3.44.0-5.el7.x86_64.rpm\nnss-softokn-freebl-3.44.0-5.el7.i686.rpm\nnss-softokn-freebl-3.44.0-5.el7.x86_64.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.i686.rpm\nnss-softokn-freebl-devel-3.44.0-5.el7.x86_64.rpm\nnss-sysinit-3.44.0-4.el7.x86_64.rpm\nnss-tools-3.44.0-4.el7.x86_64.rpm\nnss-util-3.44.0-3.el7.i686.rpm\nnss-util-3.44.0-3.el7.x86_64.rpm\nnss-util-debuginfo-3.44.0-3.el7.i686.rpm\nnss-util-debuginfo-3.44.0-3.el7.x86_64.rpm\nnss-util-devel-3.44.0-3.el7.i686.rpm\nnss-util-devel-3.44.0-3.el7.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nx86_64:\nnss-debuginfo-3.44.0-4.el7.i686.rpm\nnss-debuginfo-3.44.0-4.el7.x86_64.rpm\nnss-pkcs11-devel-3.44.0-4.el7.i686.rpm\nnss-pkcs11-devel-3.44.0-4.el7.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-0495\nhttps://access.redhat.com/security/cve/CVE-2018-12404\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2019 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXUl2i9zjgjWX9erEAQgsZg//RYLUdEWlARE9jDIOZakUKoDGisG1+EU8\nJJeTAGqksGTHEAgRpfOsYcM/uIuMXfBJmE1Gr6++KQteUhIT1aKTqbf3sdSM0fPo\n97CYjcRXejluoO45Kmw7C4o9NN2MAeoEpykFQJyqM0gLIOu+thhMzViFUEEDf5YA\njhOrkRw/xLJPhXkiUFcjBywMNsqi4TEHBKU3e+YgAUSBe2p6LaEbGJGnoFMBiskM\n1mNqCmQHs0Q7yPE8F3wOXIve+CeZvvJlJQ10a9YLSM6tkUuf6KwqSEC0F8vLOnSF\n6gpZZKXJgc70sTCJ0Eym82CHQD6kdzUBhN071P+wRX66fYai7CnbnuY77o2HVRRr\ngT0QbDrlhldxZ0DLbu81DjgmheYUhv5alY6MR/M5BcBU+MNokEgH7a00go6cbfKE\nq0kJCTpJpQN4y6t+0Tb6alXYdGLvae9QW85TxWzkYlV2uUxZEegkX07AI9XFpeCN\nYr8PjJuMy2HbrB+OAFb/gSm2kC/v37mpIxVQr4HCWcqheKIOsoF/pBELrTJe9ON4\nZLZftXKCLD/Lwb55uDzJHBhSkhCOyBCwNMj2j261keB+X8EuxI8UcnmGR87xTHnd\nQaZUxlEVzc2ZfCFl2LttiT+v0F1FlbmKkqLlXh7DU5Z05f4evtmQ9D17aQzRNDHL\nwSLYXpOCaSY\u0026NJ\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. \n\n\nHere are the details from the Slackware 14.2 ChangeLog:\n+--------------------------+\npatches/packages/mozilla-nss-3.40.1-i586-1_slack14.2.txz: Upgraded. \n Upgraded to nss-3.40.1 and nspr-4.20. \n Mitigate cache side-channel variant of the Bleichenbacher attack. \n For more information, see:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404\n (* Security fix *)\n+--------------------------+\n\n\nWhere to find the new packages:\n+-----------------------------+\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you. \n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/mozilla-nss-3.23-i486-1_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/mozilla-nss-3.23-x86_64-1_slack14.0.txz\n\nUpdated package for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mozilla-nss-3.40.1-i486-1_slack14.1.txz\n\nUpdated package for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mozilla-nss-3.40.1-x86_64-1_slack14.1.txz\n\nUpdated package for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/mozilla-nss-3.40.1-i586-1_slack14.2.txz\n\nUpdated package for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/mozilla-nss-3.40.1-x86_64-1_slack14.2.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/mozilla-nss-3.40.1-i586-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/mozilla-nss-3.40.1-x86_64-1.txz\n\n\nMD5 signatures:\n+-------------+\n\nSlackware 14.0 package:\n477aad77295cdad06550ec789db125ed mozilla-nss-3.23-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 package:\nda2b0d54d5bab3d60766691fefbfe59e mozilla-nss-3.23-x86_64-1_slack14.0.txz\n\nSlackware 14.1 package:\n2b87e41ebe92bb411f9ba6c7b3dc90a3 mozilla-nss-3.40.1-i486-1_slack14.1.txz\n\nSlackware x86_64 14.1 package:\n97f5628b15deea966d2e3a53cbf63e41 mozilla-nss-3.40.1-x86_64-1_slack14.1.txz\n\nSlackware 14.2 package:\n6d3340c45970475bc3aa8329f82c8f1c mozilla-nss-3.40.1-i586-1_slack14.2.txz\n\nSlackware x86_64 14.2 package:\n0b07bd47fca120a143111804aa70bdd3 mozilla-nss-3.40.1-x86_64-1_slack14.2.txz\n\nSlackware -current package:\n3b130c0c68b8283c5e243a5a23cfa368 l/mozilla-nss-3.40.1-i586-1.txz\n\nSlackware x86_64 -current package:\n7191a0d1e6d618e89a0e5014bde3f29e l/mozilla-nss-3.40.1-x86_64-1.txz\n\n\nInstallation instructions:\n+------------------------+\n\nUpgrade the package as root:\n# upgradepkg mozilla-nss-3.40.1-i586-1_slack14.2.txz\n\n\n+-----+\n\nSlackware Linux Security Team\nhttp://slackware.com/gpg-key\nsecurity@slackware.com\n\n+------------------------------------------------------------------------+\n| To leave the slackware-security mailing list: |\n+------------------------------------------------------------------------+\n| Send an email to majordomo@slackware.com with this text in the body of |\n| the email message: |\n| |\n| unsubscribe slackware-security |\n| |\n| You will get a confirmation message back containing instructions to |\n| complete the process. Please do not reply to this email address. ==========================================================================\nUbuntu Security Notice USN-3850-2\nFebruary 18, 2019\n\nnss vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 12.04 ESM\n\nSummary:\n\nSeveral security issues were fixed in NSS. This update provides\nthe corresponding update for Ubuntu 12.04 ESM. \n\nOriginal advisory details:\n\n Keegan Ryan discovered that NSS incorrectly handled ECDSA key\n generation. A local attacker could possibly use this issue to perform\n a cache-timing attack and recover private ECDSA keys. (CVE-2018-0495)\n\n It was discovered that NSS incorrectly handled certain v2-compatible\n ClientHello messages. A remote attacker could possibly use this issue\n to perform a replay attack. (CVE-2018-12384)\n\n It was discovered that NSS incorrectly handled certain padding\n oracles. A remote attacker could possibly use this issue to perform a\n variant of the Bleichenbacher attack", "sources": [ { "db": "NVD", "id": "CVE-2018-12404" }, { "db": "JVNDB", "id": "JVNDB-2018-015300" }, { "db": "BID", "id": "107260" }, { "db": "PACKETSTORM", "id": "153897" }, { "db": "PACKETSTORM", "id": "151073" }, { "db": "PACKETSTORM", "id": "150631" }, { "db": "PACKETSTORM", "id": "151740" } ], "trust": 2.25 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2018-12404", "trust": 3.1 }, { "db": "BID", "id": "107260", "trust": 1.9 }, { "db": "ICS CERT", "id": "ICSA-21-040-04", "trust": 1.6 }, { "db": "SIEMENS", "id": "SSA-379803", "trust": 1.6 }, { "db": "JVNDB", "id": "JVNDB-2018-015300", "trust": 0.8 }, { "db": "PACKETSTORM", "id": "151740", "trust": 0.7 }, { "db": "AUSCERT", "id": "ESB-2021.0491", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2019.0080.2", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2019.2949", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2020.3355", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2020.0342", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2019.0683", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2019.1303", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-201812-201", "trust": 0.6 }, { "db": "PACKETSTORM", "id": "153897", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "151073", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "150631", "trust": 0.1 } ], "sources": [ { "db": "BID", "id": "107260" }, { "db": "JVNDB", "id": "JVNDB-2018-015300" }, { "db": "PACKETSTORM", "id": "153897" }, { "db": "PACKETSTORM", "id": "151073" }, { "db": "PACKETSTORM", "id": "150631" }, { "db": "PACKETSTORM", "id": "151740" }, { "db": "NVD", "id": "CVE-2018-12404" }, { "db": "CNNVD", "id": "CNNVD-201812-201" } ] }, "id": "VAR-201905-0799", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 0.3152174 }, "last_update_date": "2023-12-18T11:16:58.587000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Bug 1485864", "trust": 0.8, "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=cve-2018-12404" }, { "title": "Slackware mozilla-nss Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=87486" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-015300" }, { "db": "CNNVD", "id": "CNNVD-201812-201" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "NVD-CWE-noinfo", "trust": 1.0 }, { "problemtype": "CWE-310", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-015300" }, { "db": "NVD", "id": "CVE-2018-12404" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.8, "url": "http://www.securityfocus.com/bid/107260" }, { "trust": 2.3, "url": "https://access.redhat.com/errata/rhsa-2019:2237" }, { "trust": 2.2, "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04" }, { "trust": 1.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12404" }, { "trust": 1.6, "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html" }, { "trust": 1.6, "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=cve-2018-12404" }, { "trust": 1.6, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf" }, { "trust": 1.6, "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html" }, { "trust": 1.6, "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" }, { "trust": 1.0, "url": "https://access.redhat.com/security/cve/cve-2018-12404" }, { "trust": 0.9, "url": "http://www.mozilla.org" }, { "trust": 0.9, "url": "https://developer.mozilla.org/en-us/docs/mozilla/projects/nss/nss_3.36.6_release_notes" }, { "trust": 0.9, "url": "https://developer.mozilla.org/en-us/docs/mozilla/projects/nss/nss_3.40.1_release_notes" }, { "trust": 0.9, "url": "https://eyalro.net/project/cat/" }, { "trust": 0.9, "url": "https://support.f5.com/csp/article/k10281096" }, { "trust": 0.9, "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html" }, { "trust": 0.9, "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1657913" }, { "trust": 0.9, "url": "https://usn.ubuntu.com/3850-1/" }, { "trust": 0.9, "url": "https://usn.ubuntu.com/3850-2/" }, { "trust": 0.9, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-12404" }, { "trust": 0.6, "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20184236-2.html" }, { "trust": 0.6, "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00006.html" }, { "trust": 0.6, "url": "https://www.ibm.com/support/pages/node/1284766" }, { "trust": 0.6, "url": "https://www.ibm.com/support/pages/node/1284760" }, { "trust": 0.6, "url": "https://www.ibm.com/support/pages/node/1284772" }, { "trust": 0.6, "url": "https://www.ibm.com/support/pages/node/1284778" }, { "trust": 0.6, "url": "https://www.ibm.com/support/pages/node/1284784" }, { "trust": 0.6, "url": "http://www.ubuntu.com/usn/usn-3850-1" }, { "trust": 0.6, "url": "https://www.ibm.com/blogs/psirt/security-bulletin-network-security-nss-vulnerability-affects-ibm-san-volume-controller-ibm-storwize-ibm-spectrum-virtualize-and-ibm-flashsystem-products/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2019.2949/" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/151740/ubuntu-security-notice-usn-3850-2.html" }, { "trust": 0.6, "url": "https://www.ibm.com/support/pages/node/1167190" }, { "trust": 0.6, "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019verbose-5072833.html" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.0342/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2021.0491" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/79138" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.3355/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/73866" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/76506" }, { "trust": 0.6, "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-release-for-ibm-security-identity-governance-and-intelligence-in-response-to-security-vulnerability-cve-2018-12404/" }, { "trust": 0.3, "url": "https://developer.mozilla.org/en-us/docs/mozilla/projects/nss" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-0495" }, { "trust": 0.2, "url": "https://usn.ubuntu.com/usn/usn-3850-1" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12384" }, { "trust": 0.1, "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce" }, { "trust": 0.1, "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2018-0495" }, { "trust": 0.1, "url": "https://bugzilla.redhat.com/):" }, { "trust": 0.1, "url": "https://access.redhat.com/security/team/key/" }, { "trust": 0.1, "url": "https://access.redhat.com/articles/11258" }, { "trust": 0.1, "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "trust": 0.1, "url": "https://access.redhat.com/security/team/contact/" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/nss/2:3.35-2ubuntu2.1" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/nss/2:3.28.4-0ubuntu0.14.04.4" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/nss/2:3.28.4-0ubuntu0.16.04.4" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/nss/2:3.36.1-1ubuntu1.1" }, { "trust": 0.1, "url": "http://slackware.com" }, { "trust": 0.1, "url": "http://osuosl.org)" }, { "trust": 0.1, "url": "http://slackware.com/gpg-key" }, { "trust": 0.1, "url": "https://usn.ubuntu.com/usn/usn-3850-2" } ], "sources": [ { "db": "BID", "id": "107260" }, { "db": "JVNDB", "id": "JVNDB-2018-015300" }, { "db": "PACKETSTORM", "id": "153897" }, { "db": "PACKETSTORM", "id": "151073" }, { "db": "PACKETSTORM", "id": "150631" }, { "db": "PACKETSTORM", "id": "151740" }, { "db": "NVD", "id": "CVE-2018-12404" }, { "db": "CNNVD", "id": "CNNVD-201812-201" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "BID", "id": "107260" }, { "db": "JVNDB", "id": "JVNDB-2018-015300" }, { "db": "PACKETSTORM", "id": "153897" }, { "db": "PACKETSTORM", "id": "151073" }, { "db": "PACKETSTORM", "id": "150631" }, { "db": "PACKETSTORM", "id": "151740" }, { "db": "NVD", "id": "CVE-2018-12404" }, { "db": "CNNVD", "id": "CNNVD-201812-201" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2018-11-30T00:00:00", "db": "BID", "id": "107260" }, { "date": "2019-05-23T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-015300" }, { "date": "2019-08-06T20:51:11", "db": "PACKETSTORM", "id": "153897" }, { "date": "2019-01-09T23:23:00", "db": "PACKETSTORM", "id": "151073" }, { "date": "2018-12-05T23:23:00", "db": "PACKETSTORM", "id": "150631" }, { "date": "2019-02-18T19:02:03", "db": "PACKETSTORM", "id": "151740" }, { "date": "2019-05-02T17:29:01.677000", "db": "NVD", "id": "CVE-2018-12404" }, { "date": "2018-12-06T00:00:00", "db": "CNNVD", "id": "CNNVD-201812-201" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-04-17T06:00:00", "db": "BID", "id": "107260" }, { "date": "2019-05-23T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-015300" }, { "date": "2021-02-12T07:15:12.497000", "db": "NVD", "id": "CVE-2018-12404" }, { "date": "2021-02-18T00:00:00", "db": "CNNVD", "id": "CNNVD-201812-201" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201812-201" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "NSS Cryptographic vulnerability", "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-015300" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "encryption problem", "sources": [ { "db": "CNNVD", "id": "CNNVD-201812-201" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.