Moderate: nss security update
Summary
ALSA-2024:0790: Moderate: nss security update. Affects nspr versions < 4.35.0-6.el9_3. Fixed in 4.35.0-6.el9_3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. It provides a range of cryptographic services, including SSL/TLS, certificate handling, and cryptographic algorithms. The NSS package is vulnerable to a side-channel information leak known as Minerva.
Vulnerability Detail
The Minerva side-channel information leak vulnerability (CVE-2023-6135) affects the NSS package. This vulnerability allows an attacker to exploit timing differences in cryptographic operations to extract sensitive information. By analyzing the timing of these operations, an attacker can potentially deduce private keys or other sensitive data. The impact of this vulnerability can be significant, as it compromises the confidentiality of encrypted communications and the security of cryptographic operations.
How To Fix
Minimum fixed version
4.35.0-6.el9_3
This is the first release that contains the fix.
sudo dnf update nsprTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update as soon as possible to protect against potential attacks.
Conclusion
The Minerva side-channel information leak vulnerability in the NSS package can have significant security implications. It is crucial to update the NSS package to the recommended version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nspr →
FAQ
Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. It provides cryptographic services, including SSL/TLS, certificate handling, and cryptographic algorithms.
The Minerva vulnerability allows an attacker to extract sensitive information by analyzing timing differences in cryptographic operations. This can compromise the confidentiality of encrypted communications and the security of cryptographic operations.
To fix this vulnerability, update the NSS package to version 3.90.0-6.el9_3 or later. This update includes security patches to mitigate the Minerva side-channel information leak.
There is no known workaround for this vulnerability. It is crucial to apply the security update to protect against potential attacks.
The security update can be obtained from the official AlmaLinux repositories or through package management tools like yum.
Related vulnerabilities
Recent vulnerabilities recorded for nspr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
