USN-3850-1: NSS vulnerabilities

Published Jan 9, 2019

Updated

Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perform a cache-timing attack and recover private ECDSA keys. (CVE-2018-0495) It was discovered that NSS incorrectly handled certain v2-compatible ClientHello messages. A remote attacker could possibly use this issue to perform a replay attack. (CVE-2018-12384) It was discovered that NSS incorrectly handled certain padding oracles. A remote attacker could possibly use this issue to perform a variant of the Bleichenbacher attack. (CVE-2018-12404)

Affected Software

8 affected componentsFixes available

All of the following

ubuntu/libnss3<2:3.36.1-1ubuntu1.1

2:3.36.1-1ubuntu1.1

Ubuntu Ubuntu=18.10

All of the following

ubuntu/libnss3<2:3.35-2ubuntu2.1

2:3.35-2ubuntu2.1

Ubuntu Ubuntu=18.04

All of the following

ubuntu/libnss3<2:3.28.4-0ubuntu0.16.04.4

2:3.28.4-0ubuntu0.16.04.4

Ubuntu Ubuntu=16.04

All of the following

ubuntu/libnss3<2:3.28.4-0ubuntu0.14.04.4

2:3.28.4-0ubuntu0.14.04.4

Ubuntu Ubuntu=14.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libnss3 to a version that resolves this vulnerability.
Fixed in 2:3.36.1-1ubuntu1.1
Upgrade
Upgrade ubuntu/libnss3 to a version that resolves this vulnerability.
Fixed in 2:3.35-2ubuntu2.1
Upgrade
Upgrade ubuntu/libnss3 to a version that resolves this vulnerability.
Fixed in 2:3.28.4-0ubuntu0.16.04.4
Upgrade
Upgrade ubuntu/libnss3 to a version that resolves this vulnerability.
Fixed in 2:3.28.4-0ubuntu0.14.04.4

Event History

Jan 9, 2019

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

USN-3850-1: NSS vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Company

Resources

Contact