Critical RSA Encryption Vulnerability in NSS Package
Summary
ALPINE-CVE-2018-12404: A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. Affects nss versions < 3.41-r0. Fixed in 3.41-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NSS (Network Security Services) package is a set of libraries designed to support the development of security-enabled client and server applications. It provides essential cryptographic services, including SSL/TLS protocols, and is widely used in various software applications to ensure secure communications. However, a significant vulnerability has been identified in all versions prior to NSS 3.41, which could compromise the security of encrypted data during RSA handshakes.
Vulnerability Detail
A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This vulnerability is a variant of the Adaptive Chosen Ciphertext attack, also known as the Bleichenbacher attack. It affects all NSS versions prior to NSS 3.41, potentially allowing attackers to exploit the flaw and gain unauthorized access to sensitive information.
How To Fix
Minimum fixed version
3.41-r0
This is the first release that contains the fix.
sudo apk add --upgrade nssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling RSA encryption in your application until the NSS package can be updated. However, this may impact the functionality of secure communications.
Conclusion
The NSS package has a critical vulnerability that affects its RSA encryption capabilities, potentially allowing attackers to decrypt sensitive data. It is crucial to update to the patched version 3.41-r0 to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for nss →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate level of risk.
All versions of NSS prior to 3.41 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow attackers to decrypt sensitive information, leading to data breaches and unauthorized access.
Yes, the permanent fix is to update the NSS package to version 3.41-r0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for nss.
