==========================================================================
Ubuntu Security Notice USN-4397-1
June 16, 2020
nss vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 20.04 LTS
– Ubuntu 19.10
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in NSS.
Software Description:
– nss: Network Security Service library
Details:
It was discovered that NSS incorrectly handled the TLS State Machine. A
remote attacker could possibly use this issue to cause NSS to hang,
resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.10. (CVE-2019-17023)
Cesar Pereida Garcia discovered that NSS incorrectly handled DSA key
generation. A local attacker could possibly use this issue to perform a
timing attack and recover DSA keys. (CVE-2020-12399)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
libnss3 2:3.49.1-1ubuntu1.1
Ubuntu 19.10:
libnss3 2:3.45-1ubuntu2.3
Ubuntu 18.04 LTS:
libnss3 2:3.35-2ubuntu2.8
Ubuntu 16.04 LTS:
libnss3 2:3.28.4-0ubuntu0.16.04.11
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://usn.ubuntu.com/4397-1
CVE-2019-17023, CVE-2020-12399
Package Information:
https://launchpad.net/ubuntu/+source/nss/2:3.49.1-1ubuntu1.1
https://launchpad.net/ubuntu/+source/nss/2:3.45-1ubuntu2.3
https://launchpad.net/ubuntu/+source/nss/2:3.35-2ubuntu2.8
https://launchpad.net/ubuntu/+source/nss/2:3.28.4-0ubuntu0.16.04.11
—–BEGIN PGP SIGNATURE—–
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl7pCu0ACgkQZWnYVadE
vpNjAw//cV9TL1FYL4sO3z6GtFwEMnrFaFH8tw8paVH1j9qd0PKUF8u+rGZ5wUYa
UXMF/TXDoNSeW066sNENzID3kTZx5ETcdbWPfifZnuWOe5+kSBA3bMH+xxlibJLE
nzS051wn9Sr9jhiElSptdNaB/2/3kn6ZO2wV3n9j7QXVBNNEQj1hI4i2IZQdcvGe
m6y6SyBGtoN3QrjB7jeXmPAh7DWTNpflFuIghc3AwClaajFeVMZtgTIwD9P+0h4K
/LEJJOO93oFTM6YA30t7LrkzSZfWCTsQSw48ZS2XWjgIJL1H6R2zOLbqoUEtL9q/
CMAoPlVvD8J7dSVjUOsKfYkk8zK43PMtYnQv+7eDL9ic/FWkR+16b4RJ/k2ChxFO
WO07+VxnRdPWwWuA2JYkEQ6BwupSG+i9qzg2dhYA0rjX+E9OnVdzRw1oTv+dKSIr
YVQaZgsQftLxfQWOFdd72ku8lhxqYcE1k4vkjA+2s+EZGJJ5Va587pDEo3Y02X6I
WqiefVN0wvpbm5hwBro24q7nYsES1ROWHzYAJDIfE+lPIpBCrCIEOwaNS6LgEp/2
NU54E0XiPzyau17rzESR/ek+Fo6G5VR4ED0Fw4rY8F05n8zez3a4fr56i9YxfRdz
uBrUFR5VBfcvlD0dEF3nhXrs5b/r0bbBIpaYVSGbxZeT6CRlhGQ=
=OzHm
—–END PGP SIGNATURE—–
—
