Medium: nss

Issue Overview: A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack and affects all NSS versions prior to NSS 3.41. CVE-2018-12404 Libgcrypt...

EulerOS 2.0 SP5 : nss-softokn (EulerOS-SA-2019-1979)

According to the version of the nss-softokn packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of...

firefox security update

68.1.0-1.0.1 - Rebuild to pickup Oracle default bookmarks Orabug: 30069264 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 68.1.0-1 - Update to 68.1.0 ESR 68.0.1-4 - Enable system nss...

Scientific Linux Security Update : nss, nss-softokn, nss-util, and nspr on SL7.x x86_64 (20190806)

Netscape Portable Runtime NSPR provides platform independence for non- GUI operating system facilities. The following packages have been upgraded to a later upstream version: nss 3.44.0, nss-softokn 3.44.0, nss-util 3.44.0, nspr 4.21.0. Security Fixes : - ROHNP: Key Extraction Side Channel in...

[SECURITY] [DLA 1886-2] openjdk-7 regression update

Package : openjdk-7 Version : 7u231-2.6.19-1deb8u2 Debian Bug : 935082 750400 The latest security update of openjdk-7 caused a regression when applications relied on elliptic curve algorithms to establish SSL connections. Several duplicate classes were removed from rt.jar by the upstream develope...

Debian DLA-1886-2 : openjdk-7 regression update

The latest security update of openjdk-7 caused a regression when applications relied on elliptic curve algorithms to establish SSL connections. Several duplicate classes were removed from rt.jar by the upstream developers of OpenJDK because they were also present in sunec.jar. However Debian neve...

Important Photon OS Security Update - PHSA-2019-0172

Updates of 'mysql', 'patch', 'ansible', 'redis', 'nss', 'systemd' packages of Photon OS have been released...

Security Bulletin: IBM MQ Appliance is affected by a Network Security Services (NSS) vulnerability (CVE-2017-7805)

Summary IBM MQ Appliance has addressed a vulnerability in Network Security Services NSS. Vulnerability Details CVEID: CVE-2017-7805 DESCRIPTION: Network Security Services could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in TLS 1.2 generating...

sssd security, bug fix, and enhancement update

1.16.4-21 - Resolves: rhbz1714952 - sssd RHEL 7.7 Tier 0 Localization - Rebuild japanese gmo file explicitly 1.16.4-20 - Resolves: rhbz1714952 - sssd RHEL 7.7 Tier 0 Localization 1.16.4-19 - Resolves: rhbz1707959 - sssd does not properly check GSS-SPNEGO 1.16.4-18 - Resolves: rhbz1710286 - The...

nss, nss-softokn, nss-util, and nspr security, bug fix, and enhancement update

nspr 4.21.0-1 - Rebase to NSPR 4.21 nss 3.44.0-4 - Fix certutil man page - Fix extracting a public key from a private key for dh, ec, and dsa 3.44.0-3 - Disable TLS 1.3 under FIPS mode - Disable RSASSA-PKCS1-v15 in TLS 1.3 - Fix post-handshake auth transcript calculation if SSLENABLESESSIONTICKET...

Oracle Linux 8 : nss / and / nspr (ELSA-2019-1951)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1951 advisory. nspr 4.21.0-2 - Rebuild 4.21.0-1 - Update to NSPR 4.21 nss 3.44.0-7 - Backport fixes from 3.44.1 3.44.0-6 - Add continuous RNG test required by FIPS -...

NewStart CGSL MAIN 4.05 : nss Vulnerability (NS-SA-2019-0131)

The remote NewStart CGSL host, running version MAIN 4.05, has nss packages installed that are affected by a vulnerability: - A flaw was found in the way NSS responded to an SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. A man-in-the-middle attacker could use this fla...

openSUSE Security Update : MozillaFirefox (openSUSE-2019-1811)

This update for MozillaFirefox, mozilla-nss fixes the following issues : MozillaFirefox to version ESR 60.8 : - CVE-2019-9811: Sandbox escape via installation of malicious language pack bsc1140868. - CVE-2019-11711: Script injection within domain through inner window reuse bsc1140868. -...

NewStart CGSL MAIN 4.05 : nss Vulnerability (NS-SA-2019-0112)

The remote NewStart CGSL host, running version MAIN 4.05, has nss packages installed that are affected by a vulnerability: - A use-after-free flaw was found in the TLS 1.2 implementation in the NSS library when client authentication was used. A malicious client could use this flaw to cause an...

RHEL 8 : nss and nspr (RHSA-2019:1951)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1951 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

NewStart CGSL MAIN 4.05 : nss Multiple Vulnerabilities (NS-SA-2019-0105)

The remote NewStart CGSL host, running version MAIN 4.05, has nss packages installed that are affected by multiple vulnerabilities: - An out-of-bounds write flaw was found in the way NSS performed certain Base64-decoding operations. An attacker could use this flaw to create a specially crafted...

RHEL 7 : nss, nss-softokn, nss-util, and nspr (RHSA-2019:2237)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2237 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

Information Disclosure

nss is vulnerable to information disclosure. The vulnerability exists through cache side-channel variant of the Bleichenbacher attack...

Moderate: Red Hat Security Advisory: sssd security, bug fix, and enhancement update

An update for sssd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

nss and nspr security, bug fix, and enhancement update

nspr 4.21.0-2 - Rebuild 4.21.0-1 - Update to NSPR 4.21 nss 3.44.0-7 - Backport fixes from 3.44.1 3.44.0-6 - Add continuous RNG test required by FIPS - fipstest: use CKMTLS12MASTERKEYDERIVE instead of vendor specific mechanism 3.44.0-5 - Rebuild with the correct build target 3.44.0-4.1 - rebuild t...