Alerts This Week
Warning Icon 1 1,394
Alerts This Week
Warning Icon 1 1,394

Gentoo: Mozilla NSS Standard TLS RSA Decryption Timing Flaw GLSA-202509-05

gentoo
Calendar Grey August 6, 2025
Dist Gentoo Esm H88
An urgent security notice concerning Gentoo's NSS library highlights a vulnerability related to a TLS RSA decryption timing attack, which poses risk to sensitive information.
A vulnerability has been discovered in NSS, which can lead to the recovery of private data.

Summary

A vulnerability has been discovered in Mozilla Network Security Service (NSS). Please review the CVE identifier referenced below for details.

Topics%20covered

Topics Covered

security advisory Gentoo timing attack NSS normal private data

Resolution

All Mozilla Network Security Service (NSS) users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.98"

References

[ 1 ] CVE-2023-5388 https://nvd.nist.gov/vuln/detail/CVE-2023-5388

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202508-04
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: Mozilla Network Security Service (NSS): TLS RSA decryption timing attack
Date: August 06, 2025
Bugs: #925027
ID: 202508-04

Topics%20covered

Topics Covered

security advisory Gentoo timing attack NSS normal private data

Synopsis

A vulnerability has been discovered in NSS, which can lead to the recovery of private data.

Background

The Mozilla Network Security Service is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

Package Vulnerable Unaffected ------------ ------------ ------------ dev-libs/nss < 3.98 >= 3.98

Impact

Please review the referenced CVE identifier for details.

Workaround

There is no known workaround at this time.

Your message here