USN-3850-1: NSS vulnerabilities

Packages

nss - Network Security Service library

Details

Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation.
A local attacker could possibly use this issue to perform a cache-timing
attack and recover private ECDSA keys. (CVE-2018-0495)

It was discovered that NSS incorrectly handled certain v2-compatible
ClientHello messages. A remote attacker could possibly use this issue to
perform a replay attack. (CVE-2018-12384)

It was discovered that NSS incorrectly handled certain padding oracles. A
remote attacker could possibly use this issue to perform a variant of the
Bleichenbacher attack. (CVE-2018-12404)

Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation.
A local attacker could possibly use this issue to perform a cache-timing
attack and recover private ECDSA keys. (CVE-2018-0495)

It was discovered that NSS incorrectly handled certain v2-compatible
ClientHello messages. A remote attacker could possibly use this issue to
perform a replay attack. (CVE-2018-12384)

It was discovered that NSS incorrectly handled certain padding oracles. A
remote attacker could possibly use this issue to perform a variant of the
Bleichenbacher attack. (CVE-2018-12404)

Update instructions

After a standard system update you need to restart any applications that use NSS, such as Evolution, to make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
18.10 cosmic	libnss3 – 2:3.36.1-1ubuntu1.1
18.04 bionic	libnss3 – 2:3.35-2ubuntu2.1
16.04 xenial	libnss3 – 2:3.28.4-0ubuntu0.16.04.4
14.04 trusty	libnss3 – 2:3.28.4-0ubuntu0.14.04.4

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References

Related notices