Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
Debian LTS: Security Advisory for nss (DLA-2388-1)
Information
Severity
Severity
Family
Family
CVSSv2 Base
CVSSv2 Base
CVSSv2 Vector
CVSSv2 Vector
Solution Type
Solution Type
Created
Created
Modified
Modified
Summary
The remote host is missing an update for the 'nss' package(s) announced via the DLA-2388-1 advisory.
Insight
Insight
Various vulnerabilities were fixed in nss, the Network Security Service libraries. CVE-2018-12404 Cache side-channel variant of the Bleichenbacher attack. CVE-2018-18508 NULL pointer dereference in several CMS functions resulting in a denial of service. CVE-2019-11719 Out-of-bounds read when importing curve25519 private key. CVE-2019-11729 Empty or malformed p256-ECDH public keys may trigger a segmentation fault. CVE-2019-11745 Out-of-bounds write when encrypting with a block cipher. CVE-2019-17006 Some cryptographic primitives did not check the length of the input text, potentially resulting in overflows. CVE-2019-17007 Handling of Netscape Certificate Sequences may crash with a NULL dereference leading to a denial of service. CVE-2020-12399 Force a fixed length for DSA exponentiation. CVE-2020-6829 CVE-2020-12400 Side channel attack on ECDSA signature generation. CVE-2020-12401 ECDSA timing attack mitigation bypass. CVE-2020-12402 Side channel vulnerabilities during RSA key generation. CVE-2020-12403 CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read.
Affected Software
Affected Software
'nss' package(s) on Debian Linux.
Detection Method
Detection Method
Checks if a vulnerable package version is present on the target host.
Solution
Solution
For Debian 9 stretch, these problems have been fixed in version 2:3.26.2-1.1+deb9u2. We recommend that you upgrade your nss packages.