Summary
It was discovered that NSS incorrectly handled certain signatures.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2020-12400, CVE-2020-12401, CVE-2020-6829)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | nss | 2:3.28.4-0ubuntu0.16.04.13 |
| Ubuntu · 18.04 LTS 18.04:LTS | nss | 2:3.35-2ubuntu2.11 |
| Ubuntu · 20.04 LTS 20.04:LTS | nss | 2:3.49.1-1ubuntu1.4 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | nss | 2:3.28.4-0ubuntu0.14.04.5+esm7 |
Vulnerabilities 3
-
Unscored —
When converting coordinates from projective to affine, the modular inversion was not performed in constant time, result…
-
Unscored —
During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication …
-
Unscored —
When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial …