UbuntuUpdates.org

Package "nss"

Name: nss

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Network Security Service libraries
  • Development files for the Network Security Service libraries

Latest version: 2:3.45-1ubuntu2.4
Release: eoan (19.10)
Level: security
Repository: main

Links



Other versions of "nss" in Eoan

Repository Area Version
base universe 2:3.45-1ubuntu2
base main 2:3.45-1ubuntu2
security universe 2:3.45-1ubuntu2.4
updates universe 2:3.45-1ubuntu2.4
updates main 2:3.45-1ubuntu2.4

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2:3.45-1ubuntu2.4 2020-07-06 20:06:35 UTC

  nss (2:3.45-1ubuntu2.4) eoan-security; urgency=medium

  * SECURITY UPDATE: Side channel vulnerabilities during RSA key generation
    - debian/patches/CVE-2020-12402.patch: use constant-time GCD and
      modular inversion in nss/lib/freebl/mpi/mpi.c,
      nss/lib/freebl/mpi/mpi.h, nss/lib/freebl/mpi/mplogic.c.
    - CVE-2020-12402

 -- Marc Deslauriers <email address hidden> Mon, 22 Jun 2020 13:35:40 -0400

Source diff to previous version
CVE-2020-12402 Side channel vulnerabilities during RSA key generation

Version: 2:3.45-1ubuntu2.3 2020-06-16 18:06:52 UTC

  nss (2:3.45-1ubuntu2.3) eoan-security; urgency=medium

  * SECURITY UPDATE: invalid state after HelloRetryRequest
    - debian/patches/CVE-2019-17023-1.patch: prevent negotiation of
      versions lower than 1.3 after HelloRetryRequest in
      nss/lib/ssl/ssl3con.c, nss/lib/ssl/tls13con.c.
    - debian/patches/CVE-2019-17023-2.patch: add new tests for version
      limitations after a HRR in nss/gtests/ssl_gtest/ssl_hrr_unittest.cc.
    - CVE-2019-17023
  * SECURITY UPDATE: Timing attack during DSA key generation
    - debian/patches/CVE-2020-12399.patch: force a fixed length for DSA
      exponentiation in nss/lib/freebl/dsa.c.
    - CVE-2020-12399

 -- Marc Deslauriers <email address hidden> Wed, 10 Jun 2020 12:57:22 -0400

Source diff to previous version
CVE-2019-17023 After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS
CVE-2020-12399 Force a fixed length for DSA exponentiation

Version: 2:3.45-1ubuntu2.2 2020-01-08 19:07:14 UTC

  nss (2:3.45-1ubuntu2.2) eoan-security; urgency=medium

  * SECURITY UPDATE: Possible wrong length for cryptographic primitives input
    - debian/patches/CVE-2019-17006.patch: adds checks for length of crypto
      primitives in nss/lib/freebl/chacha20poly1305.c,
      nss/lib/freebl/ctr.c, nss/lib/freebl/gcm.c,
      nss/lib/freebl/intel-gcm-wrap.c,
      nss/lib/freebl/rsapkcs.c.
    - CVE-2019-17006

 -- <email address hidden> (Leonidas S. Barbosa) Tue, 07 Jan 2020 15:31:35 -0300

Source diff to previous version
CVE-2019-17006 Check length of inputs for cryptographic primitives

Version: 2:3.45-1ubuntu2.1 2019-11-27 16:06:32 UTC

  nss (2:3.45-1ubuntu2.1) eoan-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds write in NSC_EncryptUpdate
    - debian/patches/CVE-2019-11745.patch: use maxout not block size in
      nss/lib/softoken/pkcs11c.c.
    - CVE-2019-11745

 -- Marc Deslauriers <email address hidden> Tue, 26 Nov 2019 08:35:22 -0500

CVE-2019-11745 Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate



About   -   Send Feedback to @ubuntu_updates