Timing Side-Channel Attack in NSS
Summary
CVE-2023-5388: NSS was susceptible to a timing side-channel attack when performing RSA decryption. Affects nss versions < 3.98-r0. Fixed in 3.98-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NSS (Network Security Services) is a set of libraries designed to support the development of security-enabled client and server applications. It provides implementations of SSL, TLS, PKCS, and other security standards. The vulnerability described here affects NSS versions prior to 3.98-r0 in the Alpine Linux v3.19 ecosystem.
Vulnerability Detail
NSS was found to be vulnerable to a timing side-channel attack during RSA decryption. This type of attack exploits variations in the time taken by a cryptographic operation to infer sensitive information. In this case, an attacker could potentially recover private data by analyzing the timing of RSA decryption operations. The vulnerability affects Firefox versions prior to 124, Firefox ESR versions prior to 115.9, and Thunderbird versions prior to 115.9.
How To Fix
Minimum fixed version
3.98-r0
This is the first release that contains the fix.
sudo apk add --upgrade nssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment.
Conclusion
In conclusion, the vulnerability in NSS could allow an attacker to recover private data through a timing side-channel attack during RSA decryption. It is recommended to update the affected packages to NSS version 3.98-r0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nss →
FAQ
NSS (Network Security Services) is a set of libraries designed to support the development of security-enabled client and server applications. It provides implementations of SSL, TLS, PKCS, and other security standards.
A timing side-channel attack is a type of attack that exploits variations in the time taken by a cryptographic operation to infer sensitive information.
RSA decryption is the process of decrypting data that has been encrypted using the RSA algorithm.
Firefox versions prior to 124, Firefox ESR versions prior to 115.9, and Thunderbird versions prior to 115.9 are affected by this vulnerability.
No, there is currently no known workaround for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for nss.
