Most recent entries from all

ALSA-2021:3572 — Moderate: nss and nspr security, bug fix, and enhancement update

Affected: AlmaLinux:8: nspr, AlmaLinux:8: nspr-devel, AlmaLinux:8: nss, AlmaLinux:8: nss-devel, AlmaLinux:8: nss-softokn, AlmaLinux:8: nss-softokn-devel, AlmaLinux:8: nss-softokn-freebl, AlmaLinux:8: nss-softokn-freebl-devel, AlmaLinux:8: nss-sysinit, AlmaLinux:8: nss-tools and 2 more

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

The following packages have been upgraded to a later upstream version: nss (3.67.0), nspr (4.32.0). (BZ#1967980)

Security Fix(es):

* nss: TLS 1.3 CCS flood remote DoS Attack (CVE-2020-25648)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* 8025 error code when creating subCAs (BZ#1977412)

* NSS cannot use SQL databases created by specific versions of NSS (BZ#1978443)

* Inconsistent handling of malformed CertificateRequest messages (BZ#1980050)

Enhancement(s):

* [IBM 8.5 FEAT] [P10] POWER10 performance enhancements for cryptography: NSS FreeBL (BZ#1978257)

bdu:2021-05184

Withdrawn: BELL-CVE-2020-25648 — CVE-2020-25648 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2021-avi-791 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2021-avi-791

cnvd-2020-72717

EUVD-2026-45695

fkie_cve-2020-25648

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.

GHSA-43j5-76vw-pq2j

gsd-2020-25648

OESA-2021-1115 — nss security update

Affected: openEuler:20.03-LTS: nss

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards. Security Fix(es): A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.(CVE-2020-12403)

openSUSE-SU-2024:11058-1 — libfreebl3-3.69.1-1.2 on GA media

libfreebl3-3.69.1-1.2 on GA media

RHBA-2021:2854 — Red Hat Bug Fix Advisory: Migration Toolkit for Containers (MTC) 1.4.6 release advisory

libwebp: heap-based buffer overflow in PutLE16() nss: TLS 1.3 CCS flood remote DoS Attack openldap: NULL pointer dereference for unauthenticated packet in slapd kernel: security bypass in certs/blacklist.c and certs/system_keyring.c jetty: local temporary directory hijacking vulnerability jetty: buffer not correctly recycled in Gzip Request inflation jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS libwebp: heap-based buffer overflow in WebPDecode*Into functions libwebp: use-after-free in EmitFancyRGB() in dec/io_dec.c libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c lz4: memory corruption due to an integer overflow bug caused by memmove argument libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode libxml2: Exponential entity expansion attack bypasses all existing protection mechanisms rpm: Signature checks bypass via corrupted rpm package jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity (XXE) attacks. jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP endpoints. jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnera…

SUSE-RU-2021:14818-1 — Recommended update for mozilla-nspr, mozilla-nss

Recommended update for mozilla-nspr, mozilla-nss

UBUNTU-CVE-2020-25648

Affected: Ubuntu:18.04:LTS: nss, Ubuntu:20.04:LTS: nss