Skip to content
OpenAdvisories
Unscored USN-6727-2 0 CVEs

nss regression

Published Apr 11, 2024 · Updated Apr 22, 2026

Summary

USN-6727-1 fixed vulnerabilities in NSS. The update introduced a regression
when trying to load security modules on Ubuntu 20.04 LTS and Ubuntu 22.04
LTS. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that NSS incorrectly handled padding when checking PKCS#1
certificates. A remote attacker could possibly use this issue to perform
Bleichenbacher-like attacks and recover private data. This issue only
affected Ubuntu 20.04 LTS. (CVE-2023-4421)

It was discovered that NSS had a timing side-channel when performing RSA
decryption. A remote attacker could possibly use this issue to recover
private data. (CVE-2023-5388)

It was discovered that NSS had a timing side-channel when using certain
NIST curves. A remote attacker could possibly use this issue to recover
private data. (CVE-2023-6135)

The NSS package contained outdated CA certificates. This update refreshes
the NSS package to version 3.98 which includes the latest CA certificate
bundle and other security improvements.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS nss 2:3.98-0ubuntu0.20.04.2
Ubuntu · 22.04 LTS 22.04:LTS nss 2:3.98-0ubuntu0.22.04.2

References

  • report
    https://launchpad.net/bugs/2060906