Description
mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | libapache2-mod-nss | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | mod_nss | 1.0.14-7.el7 | RHSA-2016:2602 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | apache2-mod_nss | 1.0.14-18.3 | SUSE-SU-2016:2285-1 |
| SLES 12 | apache2-mod_nss | 1.0.14-10.14.3 | SUSE-SU-2016:2396-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | apache2-mod_nss | 1.0.14-18.3 | SUSE-SU-2016:2285-1 |
| SLES for SAP 12 | apache2-mod_nss | 1.0.14-10.14.3 | SUSE-SU-2016:2396-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2-mod_nss | 1.0.14-4.1 | openSUSE-SU-2024:10311-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | mod_nss | 1.0.14-7.el7 | ELSA-2016-2602 |
Advisories 5
- RHSA-2016:2602 Red Hat Security Advisory: mod_nss security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10311-1 apache2-mod_nss-1.0.14-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2396-1 Security update for apache2-mod_nss SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2285-1 Security update for apache2-mod_nss SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2016-2602 Low: mod_nss security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 9, 2016
References
- FEDORA-2016-85e9f2e3cd vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1319052
- FEDORA-2016-8b28358b72 vendor-advisory
- RHSA-2016:2602 vendor-advisory
- FEDORA-2016-1eaaf1ed0f vendor-advisory