Ubuntu 20.04 LTS Security Advisory USN-4397-1: NSS DoS Risk

ubuntu

June 16, 2020

Several security issues were fixed in NSS.

Summary

Several security issues were fixed in NSS.

Software Description:

- nss: Network Security Service library

Details:

It was discovered that NSS incorrectly handled the TLS State Machine. A

remote attacker could possibly use this issue to cause NSS to hang,

resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS

and Ubuntu 19.10. (CVE-2019-17023)

Cesar Pereida Garcia discovered that NSS incorrectly handled DSA key

generation. A local attacker could possibly use this issue to perform a

timing attack and recover DSA keys. (CVE-2020-12399)

Topics Covered

security advisory denial of service Ubuntu local attack NSS DSA key generation

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  libnss3                         2:3.49.1-1ubuntu1.1

Ubuntu 19.10:
  libnss3                         2:3.45-1ubuntu2.3

Ubuntu 18.04 LTS:
  libnss3                         2:3.35-2ubuntu2.8

Ubuntu 16.04 LTS:
  libnss3                         2:3.28.4-0ubuntu0.16.04.11

After a standard system update you need to reboot your computer to make
all the necessary changes.