CVE-2015-5244: Critical severity red hat mod nss vulnerability
The NSSCipherSuite option of modnss accepts OpenSSL-styled cipherstrings. It was found that the parsing of such cipherstrings is flawed. If this option is used to disable insecure ciphersuites using the common "!" syntax, e.g.:
NSSCipherSuite !eNULL:!aNULL:AESGCM+aRSA:ECDH+aRSA
it will actually enable those insecure ciphersuites.
Acknowledgements:
This issue was discovered Hubert Kario of Red Hat.
Other sources
The NSSCipherSuite option with ciphersuites enabled in modnss before 1.0.12 allows remote attackers to bypass application restrictions.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5244?
CVE-2015-5244 is considered a moderate severity vulnerability due to its potential impact on the security of TLS connections.
How do I fix CVE-2015-5244?
To mitigate CVE-2015-5244, upgrade mod_nss to version 1.0.12 or later, where the cipherstring parsing flaw has been addressed.
What systems are affected by CVE-2015-5244?
CVE-2015-5244 affects mod_nss versions up to and including 1.0.11.
Can CVE-2015-5244 be exploited remotely?
Yes, CVE-2015-5244 can be exploited remotely if the vulnerable version of mod_nss is used in an exposed web server configuration.
What types of attacks can CVE-2015-5244 facilitate?
CVE-2015-5244 could facilitate attacks that exploit improper cipher configuration, potentially allowing an attacker to downgrade or compromise encrypted connections.