CVE-2016-8635: Medium severity mozilla nss esr vulnerability
It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8635?
CVE-2016-8635 is classified as a high severity vulnerability due to its potential to allow key recovery through a small subgroup confinement attack.
How do I fix CVE-2016-8635?
To fix CVE-2016-8635, update Mozilla Network Security Services (NSS) to version 3.21.5 or later.
Which software versions are affected by CVE-2016-8635?
CVE-2016-8635 affects specific versions of Mozilla NSS 3.21.x and several versions of Red Hat Enterprise Linux Desktop and Server.
What kind of attack can exploit CVE-2016-8635?
CVE-2016-8635 can be exploited using a small subgroup confinement attack to recover private keys.
Is CVE-2016-8635 related to Diffie-Hellman key exchanges?
Yes, CVE-2016-8635 involves a vulnerability in the handling of Diffie-Hellman client key exchanges.