Critical Security Update for NSPR and NSS Packages in Red Hat Enterprise Linux 9
Summary
RHSA-2024:0790: Red Hat Security Advisory: nss security update. Affects nspr versions < 0:4.35.0-6.el9_3. Fixed in 0:4.35.0-6.el9_3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
NSPR (Netscape Portable Runtime) and NSS (Network Security Services) are essential libraries used in various applications for handling network security and cryptographic operations. They provide a platform-independent API for network communication and security, making them vital for secure data transmission. The recent vulnerability affects these libraries, potentially exposing systems to security risks.
Vulnerability Detail
The vulnerability identified as CVE-2023-6135 affects the NSPR and NSS packages, allowing attackers to exploit weaknesses in the libraries. This could lead to unauthorized access or manipulation of sensitive data. The vulnerability has a CVSS score of 4.3, indicating a moderate level of risk. It is crucial for users to understand the implications of this vulnerability, as it could compromise the integrity and confidentiality of data handled by applications relying on these libraries.
How To Fix
Minimum fixed version
0:4.35.0-6.el9_3
This is the first release that contains the fix.
sudo dnf update nsprTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to applications that utilize these libraries until the update can be applied. Additionally, monitor network traffic for any unusual activity that may indicate exploitation attempts.
Conclusion
The vulnerability in the NSPR and NSS packages poses a moderate risk to systems running Red Hat Enterprise Linux 9. It is essential for users to update their packages to the patched versions to mitigate potential security threats. Regular monitoring and prompt action are crucial in maintaining system security.
See every vulnerability recorded for nspr →
FAQ
CVE-2023-6135 is a vulnerability affecting the NSPR and NSS libraries in Red Hat Enterprise Linux 9, which could allow unauthorized access to sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update immediately, restrict access to applications using these libraries and monitor for unusual network activity.
The vulnerability has a CVSS score of 4.3, indicating a moderate risk level.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2024:0790.json.
Related vulnerabilities
Recent vulnerabilities recorded for nspr.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
