Red Hat Security Advisory

RHSA-2020:1345

nss-softokn security update

Released 2020-04-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Server AUS (v. 7.4) nss-softokn-3.28.3-9.el7_4, nss-softokn-devel-3.28.3-9.el7_4, nss-softokn-freebl-3.28.3-9.el7_4 +1
Red Hat Enterprise Linux Server E4S (v. 7.4) nss-softokn-3.28.3-9.el7_4, nss-softokn-devel-3.28.3-9.el7_4, nss-softokn-freebl-3.28.3-9.el7_4 +1
Red Hat Enterprise Linux Server TUS (v. 7.4) nss-softokn-3.28.3-9.el7_4, nss-softokn-devel-3.28.3-9.el7_4, nss-softokn-freebl-3.28.3-9.el7_4 +1

Fixes 2 records

TI-2019-08802 CVE-2019-11745 · GHSA-gmvm-jpfj-v3f5

Out-of-bounds write in Mozilla Thunderbird

MEDIUM 44

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02994 Published 2020-01-08 Partial fix · 68.3, 71 CWE-787

TI-2018-00452 CVE-2018-0495 · GHSA-q2v2-pgm4-m8c8

Observable discrepancy in Libgcrypt before 1.7.10 and 1.8.x before 1.8.3

LOW 23

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign functi…

CVSS 3.0MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00869 Published 2018-06-13 Partial fix CWE-203