Skip to content
OpenAdvisories
Medium ALAS2-2021-1664 1 CVE

Moderate: nss security update (Amazon Linux 2)

Published Jun 16, 2021 · Updated Jun 22, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-25648: A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. 1887319: CVE-2020-25648 nss: TLS 1.3 CCS flood remote DoS Attack

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 nss 0:3.53.1-7.amzn2
Amazon Linux · 2 nss-debuginfo 0:3.53.1-7.amzn2
Amazon Linux · 2 nss-devel 0:3.53.1-7.amzn2
Amazon Linux · 2 nss-pkcs11-devel 0:3.53.1-7.amzn2
Amazon Linux · 2 nss-sysinit 0:3.53.1-7.amzn2
Amazon Linux · 2 nss-tools 0:3.53.1-7.amzn2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-25648.html