USN-6727-2
USN-6727-2 · nss regression
This page contains facts from public vulnerability sources. Check the original advisory before updating.
USN-6727-1 fixed vulnerabilities in NSS. The update introduced a regression when trying to load security modules on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that NSS incorrectly handled padding when checking PKCS#1 certificates. A remote attacker could possibly use this issue to perform Bleichenbacher-like attacks and recover private data. This issue only affected Ubuntu 20.04 LTS. (CVE-2023-4421) It was discovered that NSS had a timing side-channel when performing RSA decryption. A remote attacker could possibly use this issue to recover private data. (CVE-2023-5388) It was discovered that NSS had a timing side-channel when using certain NIST curves. A remote attacker could possibly use this issue to recover private data. (CVE-2023-6135) The NSS package contained outdated CA certificates. This update refreshes the NSS package to version 3.98 which includes the latest CA certificate bundle and other security improvements.
Fix available
- Published
- Updated
Stack: system
Affected products and versions
nss Ubuntu:20.04:LTS
- Versions
- 2:3.45-1ubuntu2
- 2:3.47-1ubuntu1
- 2:3.47-1ubuntu2
- 2:3.48-1ubuntu1
- 2:3.49.1-1ubuntu1
- 2:3.49.1-1ubuntu1.1
- 2:3.49.1-1ubuntu1.2
- 2:3.49.1-1ubuntu1.4
- 2:3.49.1-1ubuntu1.5
- 2:3.49.1-1ubuntu1.6
- 2:3.49.1-1ubuntu1.7
- 2:3.49.1-1ubuntu1.8
- 2:3.49.1-1ubuntu1.9
- 2:3.98-0ubuntu0.20.04.1
- Affected ranges
- ECOSYSTEM: < 2:3.98-0ubuntu0.20.04.2
Update to 2:3.98-0ubuntu0.20.04.2
nss Ubuntu:22.04:LTS
- Versions
- 2:3.68-1ubuntu1
- 2:3.68-1ubuntu2
- 2:3.68.2-0ubuntu1
- 2:3.68.2-0ubuntu1.1
- 2:3.68.2-0ubuntu1.2
- 2:3.98-0ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: < 2:3.98-0ubuntu0.22.04.2
Update to 2:3.98-0ubuntu0.22.04.2