Security Update for nss Package
Summary
DSA-2994-1: nss - security update. Affects nss versions < 2:3.14.5-1+deb7u1. Fixed in 2:3.14.5-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nss (Mozilla Network Security Service) library is a set of libraries designed to support the development of security-enabled client and server applications. It provides cryptographic services, SSL/TLS support, and certificate handling functionalities. The nss package is used by various applications to ensure secure communication and data protection.
Vulnerability Detail
The nss package is affected by multiple vulnerabilities:
-
CVE-2013-1741: This vulnerability allows an attacker to cause a crash on 64-bit computers by exploiting a runaway memset in certificate parsing, leading to an attempt to write 4GB of nulls.
-
CVE-2013-5606: Certificate validation with the verifylog mode does not return validation errors, requiring applications to manually check the log for the validation status.
-
CVE-2014-1491: This vulnerability bypasses ticket handling protection mechanisms due to the lack of restriction of public values in Diffie-Hellman key exchanges.
-
CVE-2014-1492: Incorrect IDNA domain name matching for wildcard certificates could allow specially-crafted invalid certificates to be considered as valid.
How To Fix
Minimum fixed version
2:3.14.5-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
Upgrading the nss package to the recommended versions will address the identified vulnerabilities and ensure the security of applications relying on nss for cryptographic services and secure communication. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nss →
FAQ
nss (Mozilla Network Security Service) is a set of libraries that provide cryptographic services, SSL/TLS support, and certificate handling functionalities for secure communication in client and server applications.
CVE-2013-1741 is a vulnerability in nss that allows an attacker to cause a crash on 64-bit computers by exploiting a runaway memset in certificate parsing.
CVE-2013-5606 is a vulnerability in nss where certificate validation with the verifylog mode does not return validation errors, requiring applications to manually check the log for the validation status.
CVE-2014-1491 is a vulnerability in nss that bypasses ticket handling protection mechanisms due to the lack of restriction of public values in Diffie-Hellman key exchanges.
CVE-2014-1492 is a vulnerability in nss where incorrect IDNA domain name matching for wildcard certificates could allow specially-crafted invalid certificates to be considered as valid.
Related vulnerabilities
Recent vulnerabilities recorded for nss.
