Security Update for nss Package
Summary
DLA-946-1: nss - security update. Affects nss versions < 2:3.26-1+debu7u3. Fixed in 2:3.26-1+debu7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nss package is a library that provides support for the Network Security Services (NSS) API. NSS is a set of libraries designed to support the development of security-enabled client and server applications. It provides cryptographic services, such as SSL/TLS, and implements various network protocols. The nss package is widely used in Debian 7 Wheezy.
Vulnerability Detail
The nss package is vulnerable to two security issues. The first issue, identified as CVE-2017-5461, is an out-of-bounds write vulnerability in the Base64 encoding functionality. This vulnerability can lead to a crash (denial of service) and potentially allow an attacker to execute arbitrary code. The second issue, identified as CVE-2017-5462, is a flaw in the DRBG (Deterministic Random Bit Generator) number generation. The internal state V does not correctly carry bits over, which can result in cryptographic weaknesses.
How To Fix
Minimum fixed version
2:3.26-1+debu7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update as soon as possible.
Conclusion
The nss package in Debian 7 Wheezy is vulnerable to two security issues. It is crucial to upgrade the package to version 2:3.26-1+debu7u3 or later to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nss →
FAQ
These vulnerabilities can lead to a crash (denial of service) and potentially allow an attacker to execute arbitrary code. Additionally, the flaw in the DRBG number generation can result in cryptographic weaknesses.
The vulnerabilities affect the nss package in Debian 7 Wheezy.
At the time of this advisory, there are no known exploits for these vulnerabilities. However, it is crucial to apply the security update to mitigate the risk.
You can find further information about these vulnerabilities, including the CVE identifiers, in the Debian LTS security advisories and the provided related links.
To update the nss package, you can use the package manager specific to your operating system. Run the update command to fetch and install the latest version of the package.
Related vulnerabilities
Recent vulnerabilities recorded for nss.
