SUSE-SU-2026:5168-1: Security update for mozilla-nss
This update for mozilla-nss fixes the following issue:
- remove compromised eMudhra Intermediates CA (bsc#1286261).
Changes for mozilla-nss:
- update to NSS 3.125.1 (bsc#1289144): bmo#2088196 - backport nssckbi 2.92. bmo#2082793 - Don't cache sessions when ECH was rejected. bmo#2082792 - Keep DTLS handshake messages whole in the send buffer. bmo#2082077 - Initialize sftkMACCtx in sftkMACInit. bmo#2082027 - reorder session context setup in sftkdoMACInit. bmo#2054723 - harden against integer overflows in lowpbe.c. bmo#2054697 - fix AES GCM parameter serialization in pk11GetPBECryptoMechanism. bmo#2054695 - handle HMAC truncation when using PK11Digest APIs. bmo#2054616 - reject short ciphertexts in secpkcs5rc2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/mozilla-nssto a version that resolves this vulnerability.Fixed in 3.125.1-150400.3.79.1 - Upgrade
Upgrade
mozilla-nssto a version that resolves this vulnerability.Fixed in 3.125.1 - Remove
Remove
eMudhra Intermediates CAfrom your environment.Remove the compromised eMudhra Intermediates CA.