Red Hat Security Advisory

RHSA-2021:0758

nss-softokn security update

Released 2021-03-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Server AUS (v. 7.4) nss-softokn-3.28.3-10.el7_4, nss-softokn-devel-3.28.3-10.el7_4, nss-softokn-freebl-3.28.3-10.el7_4 +1
Red Hat Enterprise Linux Server E4S (v. 7.4) nss-softokn-3.28.3-10.el7_4, nss-softokn-devel-3.28.3-10.el7_4, nss-softokn-freebl-3.28.3-10.el7_4 +1
Red Hat Enterprise Linux Server TUS (v. 7.4) nss-softokn-3.28.3-10.el7_4, nss-softokn-devel-3.28.3-10.el7_4, nss-softokn-freebl-3.28.3-10.el7_4 +1

TI-2019-12689 CVE-2019-17006 · GHSA-h4cr-x49j-2r7w

MEDIUM 48

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03558 Published 2020-10-22 Partial fix · 3.46 CWE-119

TI-2020-09921 CVE-2020-12403 · GHSA-9h25-47mw-52hh

MEDIUM 42

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01541 Published 2021-05-27 Partial fix CWE-125

TI-2019-08813 CVE-2019-11756 · GHSA-v78f-65qq-96m8

MEDIUM 41

Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01494 Published 2020-01-08 Partial fix · 71 CWE-416