Ubuntu 20.04: USN-4417-1 Critical: NSS Information Exposure

ubuntu

July 6, 2020

NSS could be made to expose sensitive information.

Summary

NSS could be made to expose sensitive information.

Software Description:

- nss: Network Security Service library

Details:

Cesar Pereida, Billy Bob Brumley, Yuval Yarom, and Nicola Tuveri discovered

that NSS incorrectly handled RSA key generation. A local attacker could

possibly use this issue to perform a timing attack and recover RSA keys.

Topics Covered

security advisory Ubuntu local attack timing attack information exposure nss

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  libnss3                         2:3.49.1-1ubuntu1.2

Ubuntu 19.10:
  libnss3                         2:3.45-1ubuntu2.4

Ubuntu 18.04 LTS:
  libnss3                         2:3.35-2ubuntu2.9

Ubuntu 16.04 LTS:
  libnss3                         2:3.28.4-0ubuntu0.16.04.12

After a standard system update you need to reboot your computer to make
all the necessary changes.