Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Red Hat Enterprise Linux 7: RHSA-2019-2237-01 Moderate: NSS Update

red hat
Calendar Grey August 6, 2019
Dist Redhat Esm H88
Attention Red Hat Users: A crucial security update has been issued for nss, nss-softokn, and associated components. Update promptly to enhance security and protect your systems.
An update for nss, nss-softokn, nss-util, and nspr is now available for Red Hat Enterprise Linux 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, applications using nss or nspr (for example, Firefox) must be restarted for this update to take effect.

Summary

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.
Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.
The following packages have been upgraded to a later upstream version: nss (3.44.0), nss-softokn (3.44.0), nss-util (3.44.0), nspr (4.21.0). (BZ#1645231, BZ#1692269, BZ#1692271, BZ#1692274)
Security Fix(es):
* ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)
* nss: Cache side-channel variant of the Bleichenbacher attack (CVE-2018-12404)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory network security Red Hat Enterprise Linux moderate severity nss update cache side-channel Cross-Platform Libraries

References

https://access.redhat.com/security/cve/CVE-2018-0495 https://access.redhat.com/security/cve/CVE-2018-12404 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index

Package List

Red Hat Enterprise Linux Client (v. 7):
Source: nspr-4.21.0-1.el7.src.rpm nss-3.44.0-4.el7.src.rpm nss-softokn-3.44.0-5.el7.src.rpm nss-util-3.44.0-3.el7.src.rpm
x86_64: nspr-4.21.0-1.el7.i686.rpm nspr-4.21.0-1.el7.x86_64.rpm nspr-debuginfo-4.21.0-1.el7.i686.rpm nspr-debuginfo-4.21.0-1.el7.x86_64.rpm nss-3.44.0-4.el7.i686.rpm nss-3.44.0-4.el7.x86_64.rpm nss-debuginfo-3.44.0-4.el7.i686.rpm nss-debuginfo-3.44.0-4.el7.x86_64.rpm nss-softokn-3.44.0-5.el7.i686.rpm nss-softokn-3.44.0-5.el7.x86_64.rpm nss-softokn-debuginfo-3.44.0-5.el7.i686.rpm nss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm nss-softokn-freebl-3.44.0-5.el7.i686.rpm nss-softokn-freebl-3.44.0-5.el7.x86_64.rpm nss-sysinit-3.44.0-4.el7.x86_64.rpm nss-tools-3.44.0-4.el7.x86_64.rpm nss-util-3.44.0-3.el7.i686.rpm nss-util-3.44.0-3.el7.x86_64.rpm nss-util-debuginfo-3.44.0-3.el7.i686.rpm nss-util-debuginfo-3.44.0-3.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: nspr-debuginfo-4.21.0-1.el7.i686.rpm nspr-debuginfo-4.21.0-1.el7.x86_64.rpm nspr-devel-4.21.0-1.el7.i686.rpm nspr-devel-4.21.0-1.el7.x86_64.rpm nss-debuginfo-3.44.0-4.el7.i686.rpm nss-debuginfo-3.44.0-4.el7.x86_64.rpm nss-devel-3.44.0-4.el7.i686.rpm nss-devel-3.44.0-4.el7.x86_64.rpm nss-pkcs11-devel-3.44.0-4.el7.i686.rpm

Read the Full Advisory


Advisory ID: RHSA-2019:2237-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2019:2237
Issue date: 2019-08-06

Topic

An update for nss, nss-softokn, nss-util, and nspr is now available for RedHat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory network security Red Hat Enterprise Linux moderate severity nss update cache side-channel Cross-Platform Libraries

Relevant Releases Architectures

Red Hat Enterprise Linux Client (v. 7) - x86_64

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

Bugs Fixed

1144186 - Cannot delete orphan private keys with certutil.

1212132 - Support for IKE/IPsec typical PKIX usage so libreswan can use nss without rejecting certs based on EKU

1431241 - Fully implement verification of RSA-PSS keys in certificates in tstclnt and selfserv [rhel-7]

1444136 - move NSS signtool to the unsupported tools in RHEL 7.6

1455288 - TLS 1.3 handshake fails with SSL_REQUIRE_SAFE_NEGOTIATION on

1508571 - Exporting RSA-PSS keys to PKCS#12 drops the rsa-pss identifier from them [rhel-7]

1508595 - Regression in handling unknown signature algorithms extensions

1509045 - selfserv refuses to use rsa-pss keys [rhel-7]

1509396 - RFC 5246 non compliance with CertificateVerify fallback to SHA-1 [rhel-7]

1510156 - RSA PKCS#1 v1.5 signatures made using rsa-pss keys are accepted as valid [rhel-7]

1514041 - certutil -O output isn't precise when the input is an ambiguous nickname used by multiple certificates

1533729 - [RFE] certutil capability: generate CSR from orphan private key

1538081 - Policy does not apply to MGF1 hash in RSA-PSS signatures [rhel-7]

1591163 - CVE-2018-0495 ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries

1639873 - mod_nss - TLS Session ID is still not maintained (ref bz 1461580)

1657164 - `certutil -u I` is not documented

1657913 - CVE-2018-12404 nss: Cache side-channel variant of the Bleichenbacher attack

1670239 - libpkix name constraints check treats CN as DNS name when it should not

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here