485 matches found
nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read
A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and strictly enforcing tag length. The highest threat from...
Moderate: Red Hat Security Advisory: nss-softokn security update
An update for nss-softokn is now available for Red Hat Enterprise Linux 7.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
RHEL 7 : nss and nss-softokn (RHSA-2021:0876)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0876 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...
nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read
A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and strictly enforcing tag length. The highest threat from...
EulerOS Virtualization 2.9.0 : nss (EulerOS-SA-2021-1640)
According to the versions of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In Network Security Services NSS before 3.46, several cryptographic primitives had missing length checks. In cases where the...
nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read
A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and strictly enforcing tag length. The highest threat from...
RHEL 7 : nss-softokn (RHSA-2021:0758)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0758 advisory. The nss-softokn package provides the Network Security Services Softoken Cryptographic Module. Security Fixes: nss: Use-after-free in...
EulerOS Virtualization for ARM 64 3.0.6.0 : nss-softokn (EulerOS-SA-2021-1536)
According to the versions of the nss-softokn packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could...
Oracle Linux 8 : nss (ELSA-2021-0538)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-0538 advisory. - CVE-2020-12403 chacha-poly issues - CVE-2020-12400 constant time ECC. - CVE-2020-6829 constant time ECC. Tenable has extracted the preceding...
CentOS 8 : nss (CESA-2021:0538)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:0538 advisory. - nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function CVE-2020-12400 - nss: CHACHA20-POLY1305 decryption with...
Moderate: Red Hat Security Advisory: nss security and bug fix update
An update for nss is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...
nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read
A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and strictly enforcing tag length. The highest threat from...
nss security and bug fix update
An update is available for nss. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Network Security Services NSS is a set of libraries designed to support the...
RLSA-2021:0538 Moderate: nss security and bug fix update
Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fixes: nss: Side channel attack on ECDSA signature generation CVE-2020-6829 nss: P-384 and P-521 implementation uses a side-channel...
Moderate: nss security and bug fix update
Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fixes: nss: Side channel attack on ECDSA signature generation CVE-2020-6829 nss: P-384 and P-521 implementation uses a side-channel...
RHEL 8 : nss (RHSA-2021:0538)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0538 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...
CentOS 8 : openssl (CESA-2019:3700)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3700 advisory. - openssl: timing side channel attack in the DSA signature algorithm CVE-2018-0734 - openssl: timing side channel attack in the ECDSA signature...
Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities
Summary IBM Security Privileged Identity Manager has addressed multiple issue for NSS and NSPR as follows. Vulnerability Details CVEID: CVE-2019-17006 DESCRIPTION: Mozilla Network Security Services NSS, as used in Mozilla Firefox is vulnerable to a heap-based buffer overflow, caused by improper...
Mozilla Rust Buffer Overflow Vulnerability
Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A buffer overflow vulnerability exists in chacha20 crate in Mozilla Rust versions prior to 0.2.3, which stems from a ChaCha20 counter overflow that can be exploited by an attacker to determine plaintext...
