Package "nss"

Name: nss


This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Network Security Service libraries
  • Debugging symbols for the Network Security Service libraries
  • Development files for the Network Security Service libraries

Latest version: 2:3.35-2ubuntu2.15
Release: bionic (18.04)
Level: updates
Repository: main


Other versions of "nss" in Bionic

Repository Area Version
base main 2:3.35-2ubuntu2
base universe 2:3.35-2ubuntu2
security main 2:3.35-2ubuntu2.15
security universe 2:3.35-2ubuntu2.15
updates universe 2:3.35-2ubuntu2.15

Packages in group

Deleted packages are displayed in grey.


Version: 2:3.35-2ubuntu2.15 2022-07-07 14:06:32 UTC

  nss (2:3.35-2ubuntu2.15) bionic-security; urgency=medium

  * SECURITY UPDATE: Crash when handling empty pkcs7 sequence
    - debian/patches/CVE-2022-22747.patch: check for missing signedData
      field in nss/gtests/certdb_gtest/decode_certs_unittest.cc,
    - CVE-2022-22747
  * SECURITY UPDATE: Free of uninitialized pointer in lg_init
    - debian/patches/CVE-2022-34480.patch: rearrange frees in
    - CVE-2022-34480

 -- Marc Deslauriers <email address hidden> Wed, 06 Jul 2022 07:25:51 -0400

Source diff to previous version

Version: 2:3.35-2ubuntu2.14 2022-05-11 10:06:22 UTC

  nss (2:3.35-2ubuntu2.14) bionic-security; urgency=medium

  * SECURITY UPDATE: Denial of service through ChangeCipherSpec
    - debian/patches/CVE-2020-25648-1.patch: reject CCS when
      compatibility is not specify or if many CCS in a row in
      nss/lib/ssl/ssl3con.c and nss/lib/ssl/sslimpl.h.
    - debian/patches/CVE-2020-25648-2.patch: reject multiple CCS
      packages but allow the first one in
      nss/lib/ssl/ssl3con.c and nss/lib/ssl/sslimpl.h.
    - CVE-2020-25648

 -- David Fernandez Gonzalez <email address hidden> Tue, 10 May 2022 13:49:35 +0200

Source diff to previous version
CVE-2020-25648 A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages,

Version: 2:3.35-2ubuntu2.13 2021-12-01 20:07:05 UTC

  nss (2:3.35-2ubuntu2.13) bionic-security; urgency=medium

  * SECURITY UPDATE: heap overflow when verifying DSA/RSA-PSS DER-encoded
    - debian/patches/CVE-2021-43527.patch: check signature lengths in
    - CVE-2021-43527

 -- Marc Deslauriers <email address hidden> Mon, 29 Nov 2021 07:16:53 -0500

Source diff to previous version
CVE-2021-43527 Heap overflow in NSS when verifying DSA/RSA-PSS DER-encoded signatures

Version: 2:3.35-2ubuntu2.12 2020-08-27 20:07:02 UTC

  nss (2:3.35-2ubuntu2.12) bionic-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds read
    - debian/patches/CVE-2020-12403-2.patch: fix incorrect call to ChaChaPoly1305 by PKCS11
      in nss/lib/freebl/chacha20poly1305.c.
    - CVE-2020-12403

 -- <email address hidden> (Leonidas S. Barbosa) Fri, 21 Aug 2020 13:32:01 -0300

Source diff to previous version

Version: 2:3.35-2ubuntu2.11 2020-08-10 19:07:12 UTC

  nss (2:3.35-2ubuntu2.11) bionic-security; urgency=medium

  * SECURITY UPDATE: Side-channel attack
    - debian/patches/CVE-2020-12400-and-6829-*.patch: use constant-time
      P-384 and P-521 in nss/lib/freebl/ecl/ecl-priv.h, nss/lib/freebl/ecl/ecl.c,
      nss/lib/freebl/ecl/ecl_spec384r1.c, nss/lib/freebl/freebl_base.gypi,
      nss/lib/freebl/manifest.mn, nss/test/ec/ectest.sh.
    - CVE-2020-12400
    - CVE-2020-6829
  * SECURITY UPDATE: Timing attack mitigation bypass
    - debian/patches/CVE-2020-12401.patch: remove unnecessary scalar
      padding in nss/lib/freebl/ec.c.
    - CVE-2020-12401

 -- <email address hidden> (Leonidas S. Barbosa) Wed, 05 Aug 2020 15:58:41 -0300

CVE-2020-12400 P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function
CVE-2020-6829 Side channel attack on ECDSA signature generation
CVE-2020-12401 ECDSA timing attack mitigation bypass

About   -   Send Feedback to @ubuntu_updates