USN-3850-2: NSS vulnerabilities
USN-3850-1 fixed several vulnerabilities in NSS. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perform a cache-timing attack and recover private ECDSA keys. (CVE-2018-0495) It was discovered that NSS incorrectly handled certain v2-compatible ClientHello messages. A remote attacker could possibly use this issue to perform a replay attack. (CVE-2018-12384) It was discovered that NSS incorrectly handled certain padding oracles. A remote attacker could possibly use this issue to perform a variant of the Bleichenbacher attack. (CVE-2018-12404)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libnss3to a version that resolves this vulnerability.Fixed in 2:3.28.4-0ubuntu0.12.04.2 - Upgrade
Upgrade
NSSto a version that resolves this vulnerability.Patch USN-3850-2
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID of this advisory?
The vulnerability ID of this advisory is USN-3850-2.
What software is affected by this vulnerability?
The vulnerability affects libnss3 version 2:3.28.4-0ubuntu0.12.04.2 on Ubuntu 12.04.
What is the remedy for this vulnerability?
The remedy for this vulnerability is to update to libnss3 version 2:3.28.4-0ubuntu0.12.04.2.
Where can I find more information about this vulnerability?
More information about this vulnerability can be found in the Ubuntu Security Notices for CVE-2018-0495, CVE-2018-12384, and CVE-2018-12404.