A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20 it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

🗓️ 10 Jun 2021 07:00:00Reported by MicrosoftType

NSS before 3.55 ChaCha20 flaw caused out-of-bounds reads; fixed by disabling multi-part ChaCha20 and enforcing tag length.

Reporter	Title	Published	Views	Family All 123
IBM Security Bulletins	Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities	12 Jan 202110:59	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security contains security vulnerabilities	13 May 202121:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2019-17006, CVE-2019-17023, CVE-2020-12403)	8 Jul 202117:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Appliance is affected by multiple nss and nspr vulnerabilities	21 Jan 202109:32	–	ibm
Tenable Nessus	Amazon Linux 2 : nspr, nss-softokn, nss-util, nss (ALAS-2020-1559)	11 Nov 202000:00	–	nessus
Tenable Nessus	Amazon Linux AMI : nspr, nss-softokn, nss-util (ALAS-2021-1522)	13 Jul 202100:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0015: nss (ALINUX3-SA-2021:0015)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : nss (CESA-2021:0538)	17 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 7 : nss and nspr (RHSA-2020:4076)	6 Nov 202000:00	–	nessus
Tenable Nessus	Debian DLA-2388-1 : nss security update	30 Sep 202000:00	–	nessus