RHSA-2021:0538: Moderate: nss security and bug fix update

Published Feb 16, 2021
·
Updated

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.Security Fix(es): nss: Side channel attack on ECDSA signature generation (CVE-2020-6829) nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function (CVE-2020-12400) nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read (CVE-2020-12403) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Bug Fix(es): Support key wrap/unwrap with RSA-OAEP (BZ#1896431) 1536bit group from RFC3526 is allowed in FIPS mode when in policy DH-MIN is set to be lower than 1536 (BZ#1896432) when NSSSDBUSECACHE not set, after curl access https, dentry increase but never released - consider alternative algorithm for benchmarking ACCESS call in sdbmeasureAccess [rhel-8] (BZ#1896933) Policy should allow overriding library defaults (BZ#1898702) KDF-self-tests-induced changes for nss in RHEL 8.4 (BZ#1898953) nss: non-blocksize requests to IKEv1 KDF returns bogus output (BZ#1904408)

Affected Software

68 affected componentsFixes available
redhat/nss<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-debugsource<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-debugsource<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-devel<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-devel<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-devel<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-devel<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-freebl<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-freebl<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-freebl-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-freebl-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-freebl-devel<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-freebl-devel<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-sysinit<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-sysinit-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-sysinit-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-tools<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-tools-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-tools-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-util<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-util<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-util-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-util-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-util-devel<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-util-devel<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-sysinit<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-tools<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-debugsource<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-devel<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-devel<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-freebl<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-freebl-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-softokn-freebl-devel<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-sysinit<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-sysinit-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-tools<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-tools-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-util<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-util-debuginfo<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss-util-devel<3.53.1-17.el8_3
3.53.1-17.el8_3
redhat/nss<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-debuginfo<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-debugsource<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-devel<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-softokn<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-softokn-debuginfo<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-softokn-devel<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-softokn-freebl<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-softokn-freebl-debuginfo<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-softokn-freebl-devel<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-sysinit<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-sysinit-debuginfo<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-tools<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-tools-debuginfo<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-util<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-util-debuginfo<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa
redhat/nss-util-devel<3.53.1-17.el8_3.aa
3.53.1-17.el8_3.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/nss to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  2. Upgrade

    Upgrade redhat/nss-debuginfo to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  3. Upgrade

    Upgrade redhat/nss-debugsource to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  4. Upgrade

    Upgrade redhat/nss-devel to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  5. Upgrade

    Upgrade redhat/nss-softokn to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  6. Upgrade

    Upgrade redhat/nss-softokn-debuginfo to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  7. Upgrade

    Upgrade redhat/nss-softokn-devel to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  8. Upgrade

    Upgrade redhat/nss-softokn-freebl to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  9. Upgrade

    Upgrade redhat/nss-softokn-freebl-debuginfo to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  10. Upgrade

    Upgrade redhat/nss-softokn-freebl-devel to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  11. Upgrade

    Upgrade redhat/nss-sysinit to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  12. Upgrade

    Upgrade redhat/nss-sysinit-debuginfo to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  13. Upgrade

    Upgrade redhat/nss-tools to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  14. Upgrade

    Upgrade redhat/nss-tools-debuginfo to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  15. Upgrade

    Upgrade redhat/nss-util to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  16. Upgrade

    Upgrade redhat/nss-util-debuginfo to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  17. Upgrade

    Upgrade redhat/nss-util-devel to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3
  18. Upgrade

    Upgrade redhat/nss to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  19. Upgrade

    Upgrade redhat/nss-debuginfo to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  20. Upgrade

    Upgrade redhat/nss-debugsource to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  21. Upgrade

    Upgrade redhat/nss-devel to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  22. Upgrade

    Upgrade redhat/nss-softokn to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  23. Upgrade

    Upgrade redhat/nss-softokn-debuginfo to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  24. Upgrade

    Upgrade redhat/nss-softokn-devel to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  25. Upgrade

    Upgrade redhat/nss-softokn-freebl to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  26. Upgrade

    Upgrade redhat/nss-softokn-freebl-debuginfo to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  27. Upgrade

    Upgrade redhat/nss-softokn-freebl-devel to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  28. Upgrade

    Upgrade redhat/nss-sysinit to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  29. Upgrade

    Upgrade redhat/nss-sysinit-debuginfo to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  30. Upgrade

    Upgrade redhat/nss-tools to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  31. Upgrade

    Upgrade redhat/nss-tools-debuginfo to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  32. Upgrade

    Upgrade redhat/nss-util to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  33. Upgrade

    Upgrade redhat/nss-util-debuginfo to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  34. Upgrade

    Upgrade redhat/nss-util-devel to a version that resolves this vulnerability.

    Fixed in 3.53.1-17.el8_3.aa
  35. Upgrade

    Upgrade Network Security Services (NSS) to a version that resolves this vulnerability.

    Patch BZ#1896431
  36. Upgrade

    Upgrade Network Security Services (NSS) to a version that resolves this vulnerability.

    Patch BZ#1896432
  37. Upgrade

    Upgrade Network Security Services (NSS) to a version that resolves this vulnerability.

    Patch BZ#1898953
  38. Upgrade

    Upgrade Network Security Services (NSS) to a version that resolves this vulnerability.

    Patch BZ#1898702
  39. Upgrade

    Upgrade Network Security Services (NSS) to a version that resolves this vulnerability.

    Patch CVE-2020-12403
  40. Upgrade

    Upgrade Network Security Services (NSS) to a version that resolves this vulnerability.

    Patch CVE-2020-12400
  41. Upgrade

    Upgrade Network Security Services (NSS) to a version that resolves this vulnerability.

    Patch BZ#1904408
  42. Operational

    After installing this NSS update (Moderate: nss security and bug fix update), restart applications using NSS (for example, Firefox) so the update takes effect.

Event History

Aug 15, 2025
Advisory Published
via Red Hat·06:46 AM
Data Sourced
via Red Hat·06:46 AM
RemedyDescriptionAffected Software

Frequently Asked Questions

1

What is the severity of RHSA-2021:0538?

The severity of RHSA-2021:0538 is categorized as important.

2

How do I fix RHSA-2021:0538?

To fix RHSA-2021:0538, update to the package version 3.53.1-17.el8_3 or later.

3

What vulnerabilities are addressed in RHSA-2021:0538?

RHSA-2021:0538 addresses security issues including a side channel attack on ECDSA signature generation (CVE-2020-6829).

4

Which software packages are affected by RHSA-2021:0538?

Affected packages include nss, nss-debuginfo, nss-devel, and various nss-softokn packages.

5

When was the RHSA-2021:0538 advisory issued?

The RHSA-2021:0538 advisory was issued on April 13, 2021.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203