Debian Security Advisory

DLA-2388-1 nss -- LTS security update

Date Reported:
29 Sep 2020
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2018-12404, CVE-2018-18508, CVE-2019-11719, CVE-2019-11729, CVE-2019-11745, CVE-2019-17006, CVE-2019-17007, CVE-2020-6829, CVE-2020-12399, CVE-2020-12400, CVE-2020-12401, CVE-2020-12402, CVE-2020-12403.
More information:

Various vulnerabilities were fixed in nss, the Network Security Service libraries.

  • CVE-2018-12404

    Cache side-channel variant of the Bleichenbacher attack.

  • CVE-2018-18508

    NULL pointer dereference in several CMS functions resulting in a denial of service.

  • CVE-2019-11719

    Out-of-bounds read when importing curve25519 private key.

  • CVE-2019-11729

    Empty or malformed p256-ECDH public keys may trigger a segmentation fault.

  • CVE-2019-11745

    Out-of-bounds write when encrypting with a block cipher.

  • CVE-2019-17006

    Some cryptographic primitives did not check the length of the input text, potentially resulting in overflows.

  • CVE-2019-17007

    Handling of Netscape Certificate Sequences may crash with a NULL dereference leading to a denial of service.

  • CVE-2020-12399

    Force a fixed length for DSA exponentiation.

  • CVE-2020-6829
  • CVE-2020-12400

    Side channel attack on ECDSA signature generation.

  • CVE-2020-12401

    ECDSA timing attack mitigation bypass.

  • CVE-2020-12402

    Side channel vulnerabilities during RSA key generation.

  • CVE-2020-12403

    CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read.

For Debian 9 stretch, these problems have been fixed in version 2:3.26.2-1.1+deb9u2.

We recommend that you upgrade your nss packages.

For the detailed security status of nss please refer to its security tracker page at:

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: