RHSA-2019:1951: Moderate: nss and nspr security, bug fix, and enhancement update

First published: Tue Jul 30 2019(Updated: )

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.<br>Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.<br>The following packages have been upgraded to a later upstream version: nss (3.44.0), nspr (4.21.0). (BZ#1713187, BZ#1713188)<br>Security Fix(es):<br><li> nss: NULL pointer dereference in several CMS functions resulting in a denial of service (CVE-2018-18508)</li> <li> nss: Out-of-bounds read when importing curve25519 private key (CVE-2019-11719)</li> <li> nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (CVE-2019-11729)</li> <li> nss: PKCS#1 v1.5 signatures can be used for TLS 1.3 (CVE-2019-11727)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br><li> PQG verify fails when create DSA PQG parameters because the counts aren't returned correctly. (BZ#1685325)</li> <li> zeroization of AES context missing (BZ#1719629)</li> <li> RSA Pairwise consistency test (BZ#1719630)</li> <li> FIPS updated for nss-softoken POST (BZ#1722373)</li> <li> DH/ECDH key tests missing for the PG parameters (BZ#1722374)</li> <li> NSS should implement continuous random test on it's seed data or use the kernel AF_ALG interface for random (BZ#1725059)</li> <li> support setting supported signature algorithms in strsclnt utility (BZ#1725110)</li> <li> certutil -F with no parameters is killed with segmentation fault message (BZ#1725115)</li> <li> NSS: Support for IKE/IPsec typical PKIX usage so libreswan can use nss without rejecting certs based on EKU (BZ#1725116)</li> <li> NSS should use getentropy() for seeding its RNG, not /dev/urandom. Needs update to NSS 3.37 (BZ#1725117)</li> <li> Disable TLS 1.3 in FIPS mode (BZ#1725773)</li> <li> Wrong alert sent when client uses PKCS#1 signatures in TLS 1.3 (BZ#1728259)</li> <li> x25519 allowed in FIPS mode (BZ#1728260)</li> <li> post handshake authentication with selfserv does not work if SSL_ENABLE_SESSION_TICKETS is set (BZ#1728261)</li> Enhancement(s):<br><li> Move IKEv1 and IKEv2 KDF's from libreswan to nss-softkn (BZ#1719628)</li>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2019:1951
• agent/software-canonical-lookup
• package-manager/redhat