p PatchFirst

CVE-2016-8635

CVE-2016-8635

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.

CVSS 5.3 · Medium · EPSS 2.0% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • nss

    Versions
    • 3.21.x: Affected

    No fix published

  • nss Debian:12

    Affected ranges
    • ECOSYSTEM: < 2:3.25-1

    Update to 2:3.25-1

  • nss Debian:13

    Affected ranges
    • ECOSYSTEM: < 2:3.25-1

    Update to 2:3.25-1

  • nss Debian:14

    Affected ranges
    • ECOSYSTEM: < 2:3.25-1

    Update to 2:3.25-1

  • nss Ubuntu:14.04:LTS

    Versions
    • 2:3.15.1-1ubuntu1
    • 2:3.15.2-1
    • 2:3.15.3-1
    • 2:3.15.3.1-1
    • 2:3.15.3.1-1.1
    • 2:3.15.3.1-1.1ubuntu1
    • 2:3.15.4-1ubuntu3
    • 2:3.15.4-1ubuntu4
    • 2:3.15.4-1ubuntu5
    • 2:3.15.4-1ubuntu6
    • 2:3.15.4-1ubuntu7
    • 2:3.15.4-1ubuntu7.1
    • 2:3.17-0ubuntu0.14.04.1
    • 2:3.17.1-0ubuntu0.14.04.1
    • 2:3.17.1-0ubuntu0.14.04.2
    • 2:3.17.4-0ubuntu0.14.04.1
    • 2:3.19.2-0ubuntu0.14.04.1
    • 2:3.19.2.1-0ubuntu0.14.04.1
    • 2:3.19.2.1-0ubuntu0.14.04.2
    • 2:3.21-0ubuntu0.14.04.1
    • 2:3.21-0ubuntu0.14.04.2
    • 2:3.23-0ubuntu0.14.04.1
    Affected ranges
    • ECOSYSTEM: < 2:3.26.2-0ubuntu0.14.04.3

    Update to 2:3.26.2-0ubuntu0.14.04.3

  • nss Ubuntu:16.04:LTS

    Versions
    • 2:3.19.2-1ubuntu1
    • 2:3.19.2.1-0ubuntu1
    • 2:3.21-1ubuntu2
    • 2:3.21-1ubuntu3
    • 2:3.21-1ubuntu4
    • 2:3.23-0ubuntu0.16.04.1
    Affected ranges
    • ECOSYSTEM: < 2:3.26.2-0ubuntu0.16.04.2

    Update to 2:3.26.2-0ubuntu0.16.04.2

Original sources

Check your server →