Debian Security Advisory
DLA-2388-1 nss -- LTS security update
- Date Reported:
- 29 Sep 2020
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2018-12404, CVE-2018-18508, CVE-2019-11719, CVE-2019-11729, CVE-2019-11745, CVE-2019-17006, CVE-2019-17007, CVE-2020-6829, CVE-2020-12399, CVE-2020-12400, CVE-2020-12401, CVE-2020-12402, CVE-2020-12403.
- More information:
Various vulnerabilities were fixed in nss, the Network Security Service libraries.
Cache side-channel variant of the Bleichenbacher attack.
NULL pointer dereference in several CMS functions resulting in a denial of service.
Out-of-bounds read when importing curve25519 private key.
Empty or malformed p256-ECDH public keys may trigger a segmentation fault.
Out-of-bounds write when encrypting with a block cipher.
Some cryptographic primitives did not check the length of the input text, potentially resulting in overflows.
Handling of Netscape Certificate Sequences may crash with a NULL dereference leading to a denial of service.
Force a fixed length for DSA exponentiation.
Side channel attack on ECDSA signature generation.
ECDSA timing attack mitigation bypass.
Side channel vulnerabilities during RSA key generation.
CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read.
For Debian 9 stretch, these problems have been fixed in version 2:3.26.2-1.1+deb9u2.
We recommend that you upgrade your nss packages.
For the detailed security status of nss please refer to its security tracker page at: https://security-tracker.debian.org/tracker/nss
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS