Buffer Overflow Affecting nss-sysinit package, versions <0:3.67.0-7.el8_4


Severity

Recommended
0.0
critical
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.91% (83rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-NSSSYSINIT-4142881
  • published2 Dec 2021
  • disclosed1 Dec 2021

Introduced: 1 Dec 2021

CVE-2021-43527  (opens in a new tab)
CWE-120  (opens in a new tab)

How to fix?

Upgrade RHEL:8 nss-sysinit to version 0:3.67.0-7.el8_4 or higher.
This issue was patched in RHSA-2021:4909.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

CVSS Scores

version 3.1