Vulnerability in nss - security update
Summary
DLA-677-1: nss - security update. Affects nss versions < 2:3.26-1+debu7u1. Fixed in 2:3.26-1+debu7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Network Security Service (NSS) libraries are used to configure various aspects of network security, including file system locations. These libraries are susceptible to a vulnerability that allows environment variables to degrade the operation of NSS or force compatibility modes. Previously, SUID binaries did not ignore these environment variables. To address this issue, the NetScape Portable Runtime Library (NSPR) introduced a new API called PR_GetEnVSecure. Upgrading both NSPR and NSS is necessary to fix this vulnerability. The affected package is nss in Debian 7 Wheezy.
Vulnerability Detail
The vulnerability in nss allows environment variables to be used in a way that can compromise the security and functionality of the NSS libraries. By manipulating these variables, an attacker can force compatibility modes or cause other issues. This vulnerability can potentially lead to unauthorized access, data breaches, or denial of service attacks.
How To Fix
Minimum fixed version
2:3.26-1+debu7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in nss can be fixed by upgrading the nss package to version 3.26-1+debu7u1 or later. It is important to upgrade both NSPR and NSS to fully address the issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nss →
FAQ
This vulnerability can potentially lead to unauthorized access, data breaches, or denial of service attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will alert you in real-time.
There is no specific workaround mentioned for this vulnerability.
To upgrade the nss package, follow the instructions provided by Debian LTS security advisories.
Yes, this vulnerability affects the nss package in Debian 7 Wheezy. It is recommended to upgrade to version 3.26-1+debu7u1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for nss.
