Buffer Overflow Affecting nss package, versions <0:3.44.0-10.el8_1


Severity

Recommended
0.0
critical
0
10

Based on Red Hat Enterprise Linux security rating

    Threat Intelligence

    EPSS
    0.53% (78th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RHEL8-NSS-3948746
  • published 2 Dec 2021
  • disclosed 1 Dec 2021

How to fix?

Upgrade RHEL:8 nss to version 0:3.44.0-10.el8_1 or higher.
This issue was patched in RHSA-2021:4953.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

CVSS Scores

version 3.1
Expand this section

NVD

9.8 critical
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    High
Expand this section

Red Hat

9.8 critical
Expand this section

SUSE

8.8 high