USN-4397-1 — nss vulnerabilities

Summary

It was discovered that NSS incorrectly handled the TLS State Machine. A
remote attacker could possibly use this issue to cause NSS to hang,
resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.10. (CVE-2019-17023)

Cesar Pereida Garcia discovered that NSS incorrectly handled DSA key
generation. A local attacker could possibly use this issue to perform a
timing attack and recover DSA keys. (CVE-2020-12399)

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	nss	2:3.28.4-0ubuntu0.16.04.11
Ubuntu · 18.04 LTS 18.04:LTS	nss	2:3.35-2ubuntu2.8
Ubuntu · 20.04 LTS 20.04:LTS	nss	2:3.49.1-1ubuntu1.1

Vulnerabilities 2

Unscored —

CVE-2019-17023

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invali…

Mozilla Firefox firefox librewolf Browsers Debian Ubuntu Alpine

Jan 8, 2020
Unscored —

CVE-2020-12399

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak privat…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Jul 9, 2020

References

report
https://ubuntu.com/security/CVE-2019-17023
report
https://ubuntu.com/security/CVE-2020-12399

nss vulnerabilities

Summary

Fixed packages 3

Vulnerabilities 2

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invali…

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak privat…

References