<p>Upgrade <code>Ubuntu:18.04</code> <code>nss</code> to version 2:3.35-2ubuntu2.15 or higher.</p>

Improper Certificate Validation Affecting nss package, versions <2:3.35-2ubuntu2.15

Snyk CVSS

Attack Complexity Low

User Interaction Required

Availability High

Threat Intelligence

EPSS 0.1% (40^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-UBUNTU1804-NSS-2767563
published 14 Jan 2022
disclosed 22 Dec 2022

Report a new vulnerability Found a mistake?

Introduced: 14 Jan 2022

CVE-2022-22747 Open this link in a new tab CWE-295 Open this link in a new tab

How to fix?

Upgrade Ubuntu:18.04 nss to version 2:3.35-2ubuntu2.15 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Ubuntu. See How to fix? for Ubuntu:18.04 relevant fixed versions and status.

After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.