Critical Security Advisory: NSPR and NSS Vulnerabilities in Red Hat Enterprise Linux 9
Summary
RHSA-2023:1368: Red Hat Security Advisory: nss security and bug fix update. Affects nspr versions < 0:4.34.0-17.el9_1. Fixed in 0:4.34.0-17.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NSPR (Netscape Portable Runtime) and NSS (Network Security Services) are essential libraries in Red Hat Enterprise Linux 9 that provide platform-independent APIs for network programming and security. They are widely used in applications that require secure communications, cryptographic operations, and other security-related functionalities. The recent vulnerabilities identified in these packages could potentially compromise the integrity and confidentiality of applications relying on them.
Vulnerability Detail
The vulnerability, identified as CVE-2023-0767, affects multiple packages including NSPR and NSS. It originates from insufficient validation of input data, which could allow an attacker to exploit the flaw, leading to unauthorized access, data leakage, or even complete system compromise. The CVSS score for this vulnerability is 8.8, indicating a high severity level that necessitates immediate attention from system administrators and developers.
How To Fix
Minimum fixed version
0:4.34.0-17.el9_1
This is the first release that contains the fix.
sudo dnf update nsprTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to limit access to the affected applications and monitor network traffic for any suspicious activities until the packages are updated. Additionally, consider implementing stricter input validation in applications that utilize these libraries.
Conclusion
The vulnerabilities in NSPR and NSS libraries pose significant risks to applications running on Red Hat Enterprise Linux 9. It is imperative for users to update their packages to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for nspr →
FAQ
CVE-2023-0767 is a security vulnerability affecting NSPR and NSS libraries in Red Hat Enterprise Linux 9, which could lead to unauthorized access and data leakage.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without requiring code access.
If immediate updates are not possible, implement strict access controls and monitor for unusual activity as a temporary measure.
The CVSS score for this vulnerability is 8.8, indicating a high severity level that requires prompt action.
Detailed information can be found in the Red Hat Security Advisory RHSA-2023:1368, which outlines the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for nspr.
