Description
The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | apache2-mod_nss | 1.0.14-18.3 | SUSE-SU-2016:2285-1 |
| SLES 12 | apache2-mod_nss | 1.0.14-10.14.3 | SUSE-SU-2016:2396-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | apache2-mod_nss | 1.0.14-18.3 | SUSE-SU-2016:2285-1 |
| SLES for SAP 12 | apache2-mod_nss | 1.0.14-10.14.3 | SUSE-SU-2016:2396-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2-mod_nss | 1.0.14-4.1 | openSUSE-SU-2024:10311-1 |
Advisories 3
- openSUSE-SU-2024:10311-1 apache2-mod_nss-1.0.14-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2396-1 Security update for apache2-mod_nss SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2285-1 Security update for apache2-mod_nss SUSE / openSUSE Security Updates · May 2, 2025