REDHAT-BUG-1242456: Medium severity mozilla network security services vulnerability
It was discovered that the Elliptic Curve (EC) cryptography code as used in Mozilla NSS (Network Security Services) library and OpenJDK JCE (Java Cryptography Extension) component failed to properly validate EC parameters as used in ECDHDerive() function, which performs ECDH (Elliptic Curve Diffie-Hellman) key derivation. A remote attacker could use this flaw to disclose sensitive information.
The OpenJDK packages as shipped with Red Hat Enterprise Linux 5, 6 and 7 do not build the affected EC code and are therefore not directly affected. Future versions may provide EC support via NSS, see e.g. bug 1075702.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1242456?
The severity of REDHAT-BUG-1242456 is considered high due to improper validation in the cryptography code.
How do I fix REDHAT-BUG-1242456?
Fix REDHAT-BUG-1242456 by updating the affected versions of Mozilla NSS and Oracle OpenJDK to the latest secure releases.
What impact does REDHAT-BUG-1242456 have on my system?
REDHAT-BUG-1242456 may allow attackers to exploit the improper validation of EC parameters, potentially compromising secure communications.
Which software is affected by REDHAT-BUG-1242456?
The affected software for REDHAT-BUG-1242456 includes Mozilla Network Security Services (NSS) and Oracle OpenJDK.
Is there a workaround for REDHAT-BUG-1242456?
There is no specific workaround for REDHAT-BUG-1242456; the recommended action is to apply the available patch or update.