nss and nspr security, bug fix, and enhancement update

nspr 4.25.0-2 - Rebuild 4.25.0-1 - Update to NSPR 4.25 nss 3.53.1-11 - Fix issue with upgradedb where upgradedb expects standard to generate dbm databases, not sql databases default in RHEL8 3.53.1-10 - Disable dh timing test because it's unreliable on s390 3.53.1-9 - Explicitly enable...

Moderate: nss and nspr security, bug fix, and enhancement update

Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime NSPR provides platform independence for non-GUI operating system facilities. The following packages have been upgrad...

nss and nspr security, bug fix, and enhancement update

An update is available for nspr. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Network Security Services NSS is a set of libraries designed to support the...

RHEL 8 : nss and nspr (RHSA-2020:3280)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3280 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

CVE-2020-12401

A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDS...

CVE-2020-12400

A side-channel flaw was found in NSS, in the way P-384 and P-521 curves are used in the generation of EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this...

CVE-2020-6829

A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDS...

Fedora 31 : 1:java-11-openjdk (2020-93cc9c3ef2)

July 2020 OpenJDK security update for OpenJDK 11 Full release notes: https://bitly.com/openjdk1108 Security fixes - JDK-8230613: Better ASCII conversions - JDK-8231800: Better listing of arrays - JDK-8232014: Expand DTD support - JDK-8233234: Better Zip Naming - JDK-8233239, CVE-2020-14562: Enhan...

GLSA-202007-49 : Mozilla Network Security Service (NSS): Information disclosure

The remote host is affected by the vulnerability described in GLSA-202007-49 Mozilla Network Security Service NSS: Information disclosure NSS was found to not always perform constant-time operations when working with DSA key material. Impact : An attacker may be able to obtain information about a...

Fedora 32 : 1:java-11-openjdk (2020-5d0b4a2b5b)

July 2020 OpenJDK security update for OpenJDK 11 Full release notes: https://bitly.com/openjdk1108 Security fixes - JDK-8230613: Better ASCII conversions - JDK-8231800: Better listing of arrays - JDK-8232014: Expand DTD support - JDK-8233234: Better Zip Naming - JDK-8233239, CVE-2020-14562: Enhan...

Mozilla Network Security Service (NSS): Information disclosure

Background The Mozilla Network Security Service NSS is a library implementing security features like SSL v.2/v.3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME and X.509 certificates. Description NSS was found to not always perform constant-time operations when working with DSA key material. Impa...

Fedora 32 : 1:java-1.8.0-openjdk (2020-e418151dc3)

July 2020 OpenJDK security update for OpenJDK 8. Full release notes: https://bitly.com/oj8u262 New features - JDK-8223147: JFR Backport Security fixes - JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equalsDerValue - JDK-8028591, CVE-2020-14578: NegativeArraySizeException in...

Fedora: Security Advisory for nss (FEDORA-2020-3ef1937475)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : mozilla-nss (openSUSE-2020-953)

This update for mozilla-nss fixes the following issues : mozilla-nss was updated to version 3.53.1 - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation bsc1173032 - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony...

openSUSE Security Update : mozilla-nspr / mozilla-nss (openSUSE-2020-854)

This update for mozilla-nspr, mozilla-nss fixes the following issues : mozilla-nss was updated to version 3.53 - CVE-2020-12399: Fixed a timing attack on DSA signature generation bsc1171978. - CVE-2019-17006: Added length checks for cryptographic primitives bsc1159819. Release notes:...

Debian DSA-4726-1 : nss - security update

Several vulnerabilities were discovered in NSS, a set of cryptographic libraries, which may result in side channel/timing attacks or denial of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4726. Th...

Fedora 32 : nspr / nss (2020-3ef1937475)

Updates the nspr and nss package to upstream NSPR 4.26 and NSS 3.54. For details about new functionality and a list of bugs fixed in this release please see the upstream release notes : - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS3.54releasenotes Note that Tenable Network...

openSUSE Security Update : mozilla-nss (openSUSE-2020-955)

This update for mozilla-nss fixes the following issues : mozilla-nss was updated to version 3.53.1 - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation bsc1173032 - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony...

[SECURITY] Fedora 32 Update: nss-3.54.0-1.fc32

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

Security Bulletin: Multiple vulnerabilities in expat, nss,  bind ,  policycoreutils, sudo shipped with  SmartCloud Entry Appliance

Summary Multiple vulnerabilities have been idintified in Expat, nss, ISC BIND , policycoreutils and sudo libraries shipped with SmartCloud Entry Appliance. SmartCloud Entry Appliance has addressed the vulnerabilities. Vulnerability Details CVEID: CVE-2016-0718 DESCRIPTION: Expat is vulnerable to ...