Summary
It was discovered that NSS incorrectly handled padding when checking PKCS#1
certificates. A remote attacker could possibly use this issue to perform
Bleichenbacher-like attacks and recover private data. This issue only
affected Ubuntu 20.04 LTS. (CVE-2023-4421)
It was discovered that NSS had a timing side-channel when performing RSA
decryption. A remote attacker could possibly use this issue to recover
private data. (CVE-2023-5388)
It was discovered that NSS had a timing side-channel when using certain
NIST curves. A remote attacker could possibly use this issue to recover
private data. (CVE-2023-6135)
The NSS package contained outdated CA certificates. This update refreshes
the NSS package to version 3.98 which includes the latest CA certificate
bundle and other security improvements.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | nss | 2:3.98-0ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | nss | 2:3.98-0ubuntu0.22.04.1 |
Vulnerabilities 3
-
Medium 6.5
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow…
-
Unscored —
The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both…
-
Unscored —
Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially al…