Ubuntu 21.10: USN-5169-1 Critical: OpenSSL Security Vulnerability Alert

ubuntu

December 1, 2021

NSS could be made to crash or run programs if it verified a specially crafted signature.

Summary

NSS could be made to crash or run programs if it verified a specially

crafted signature.

Software Description:

- nss: Network Security Service library

Details:

Tavis Ormandy discovered that NSS incorrectly handled verifying DSA/RSA-PSS

signatures. A remote attacker could use this issue to cause NSS to crash,

resulting in a denial of service, or possibly execute arbitrary code.

Topics Covered

security advisory denial of service software update ubuntu nss

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  libnss3                         2:3.68-1ubuntu1.1

Ubuntu 21.04:
  libnss3                         2:3.61-1ubuntu2.1

Ubuntu 20.04 LTS:
  libnss3                         2:3.49.1-1ubuntu1.6

Ubuntu 18.04 LTS:
  libnss3                         2:3.35-2ubuntu2.13

After a standard system update you need to restart any applications that
use NSS, such as Evolution, to make all the necessary changes.