Medium ELSA-2024-0108 1 CVE

Moderate: nss security update (Oracle Linux 9)

Published Jan 10, 2024 · Updated Jan 10, 2024

Ecosystem: Oracle Linux

Summary

[3.90.0-4]
- CVE-2023-5388
nss: timing attack against RSA decryption.
Make the final blinding multmod constant time.

Fixed packages 12

Release	Package	Fixed in
Oracle Linux · 9	nspr	0:4.35.0-4.el9_3
Oracle Linux · 9	nspr-devel	0:4.35.0-4.el9_3
Oracle Linux · 9	nss	0:3.90.0-4.el9_3
Oracle Linux · 9	nss-devel	0:3.90.0-4.el9_3
Oracle Linux · 9	nss-softokn	0:3.90.0-4.el9_3
Oracle Linux · 9	nss-softokn-devel	0:3.90.0-4.el9_3
Oracle Linux · 9	nss-softokn-freebl	0:3.90.0-4.el9_3
Oracle Linux · 9	nss-softokn-freebl-devel	0:3.90.0-4.el9_3
Oracle Linux · 9	nss-sysinit	0:3.90.0-4.el9_3
Oracle Linux · 9	nss-tools	0:3.90.0-4.el9_3
Oracle Linux · 9	nss-util	0:3.90.0-4.el9_3
Oracle Linux · 9	nss-util-devel	0:3.90.0-4.el9_3

Vulnerabilities 1

Medium 6.5

CVE-2023-5388

NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Mar 19, 2024