Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
amazonAmazonALAS-2016-714
HistoryJun 15, 2016 - 1:30 p.m.

Low: mod24_nss

2016-06-1513:30:00
alas.aws.amazon.com
19

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.005

Percentile

76.1%

JSON

Issue Overview:

It was reported that +CIPHER operator in OpenSSL changes the order of a cipher. Instead of returning an error (as NSS does not support cipher ordering), it returned the result of processing up to that point, which could result in requested ciphers not being enabled.

Affected Packages:

mod24_nss

Issue Correction:
Run yum update mod24_nss to update your system.

New Packages:

i686:  
    mod24_nss-1.0.12-4.22.amzn1.i686  
    mod24_nss-debuginfo-1.0.12-4.22.amzn1.i686  
  
src:  
    mod24_nss-1.0.12-4.22.amzn1.src  
  
x86_64:  
    mod24_nss-debuginfo-1.0.12-4.22.amzn1.x86_64  
    mod24_nss-1.0.12-4.22.amzn1.x86_64

Additional References

Red Hat: CVE-2016-3099

Mitre: CVE-2016-3099

Related

ubuntucve 1
nessus 15
redhat 1
fedora 3
openvas 9
cve 1
centos 1
nvd 1
cvelist 1
oraclelinux 1
prion 1
mageia 1
veracode 1
debiancve 1
osv 1
ubuntucve
ubuntucve
CVE-2016-3099
2017-06-08 00:00:00
nessus
nessus
Fedora 22 : mod_nss-1.0.11-7.fc22 (2016-85e9f2e3cd)
2016-04-27 00:00:00
RHEL 7 : mod_nss (RHSA-2016:2602)
2016-11-04 00:00:00
RHEL 5 : mod_nss (Unpatched Vulnerability)
2024-05-11 00:00:00
redhat
redhat
(RHSA-2016:2602) Low: mod_nss security, bug fix, and enhancement update
2016-11-03 06:07:16
fedora
fedora
[SECURITY] Fedora 24 Update: mod_nss-1.0.12-4.fc24
2016-05-07 13:44:15
[SECURITY] Fedora 23 Update: mod_nss-1.0.12-3.fc23
2016-04-25 23:57:19
[SECURITY] Fedora 22 Update: mod_nss-1.0.11-7.fc22
2016-04-25 22:22:52
openvas
openvas
Fedora Update for mod_nss FEDORA-2016-1
2016-05-08 00:00:00
Mageia: Security Advisory (MGASA-2016-0197)
2022-01-28 00:00:00
RedHat Update for mod_nss RHSA-2016:2602-02
2016-11-04 00:00:00
cve
cve
CVE-2016-3099
2017-06-08 19:29:00
centos
centos
mod_nss security update
2016-11-25 16:00:20
nvd
nvd
CVE-2016-3099
2017-06-08 19:29:00
cvelist
cvelist
CVE-2016-3099
2017-06-08 19:00:00
oraclelinux
oraclelinux
mod_nss security, bug fix, and enhancement update
2016-11-09 00:00:00
prion
prion
Code injection
2017-06-08 19:29:00
mageia
mageia
Updated apache-mod_nss packages fix CVE-2016-3099
2016-05-22 01:11:24
veracode
veracode
Unintended Cipher
2020-12-06 04:49:47
debiancve
debiancve
CVE-2016-3099
2017-06-08 19:29:00
osv
osv
apache2-mod_nss-1.0.14-4.1 on GA media
2024-06-15 00:00:00

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.005

Percentile

76.1%

JSON
Related for ALAS-2016-714
ubuntucve1nessus15redhat1fedora3openvas9cve1centos1nvd1cvelist1oraclelinux1prion1mageia1veracode1debiancve1osv1