Moderate: nss security update
Summary
ALSA-2024:0786: Moderate: nss security update. Affects nss versions < 3.90.0-6.el8_9. Fixed in 3.90.0-6.el8_9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. It provides a range of cryptographic services, including SSL/TLS, certificate handling, and cryptographic algorithms. The vulnerability described in this report affects the nss package in AlmaLinux 8.
Vulnerability Detail
The nss package is vulnerable to a Minerva side-channel information leak (CVE-2023-6135). This vulnerability could allow an attacker to obtain sensitive information by exploiting a side-channel timing attack. The impact of this vulnerability could vary depending on the specific application using the nss package, but it has the potential to expose confidential data, compromise the integrity of cryptographic operations, and undermine the security of affected systems.
How To Fix
Minimum fixed version
3.90.0-6.el8_9
This is the first release that contains the fix.
sudo dnf update nssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to apply the security update as soon as possible.
Conclusion
The nss package in AlmaLinux 8 is vulnerable to a Minerva side-channel information leak. To mitigate this vulnerability, it is crucial to update the nss package to version 3.90.0-6.el8_9 or later. Applying the security update will help protect against potential attacks and ensure the confidentiality and integrity of cryptographic operations. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nss →
FAQ
Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. It provides cryptographic services, including SSL/TLS, certificate handling, and cryptographic algorithms.
The vulnerability could allow an attacker to obtain sensitive information by exploiting a side-channel timing attack. The impact could vary depending on the specific application using the nss package, but it has the potential to expose confidential data, compromise cryptographic operations, and undermine system security.
To fix this vulnerability, update the nss package to version 3.90.0-6.el8_9 or later. This update includes security patches to mitigate the Minerva side-channel information leak. You can obtain the update from the official AlmaLinux repositories or through package management tools like yum.
No specific workaround is mentioned for this vulnerability. It is recommended to apply the security update as soon as possible.
You can find more information about this vulnerability, including the impact, CVSS score, acknowledgments, and related details, on the CVE page: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6135
Related vulnerabilities
Recent vulnerabilities recorded for nss.
