Red Hat Security Advisory

RHSA-2021:1026

nss-softokn security update

Released 2021-03-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) nss-softokn-3.44.0-9.el7_7, nss-softokn-freebl-3.44.0-9.el7_7
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) nss-softokn-devel-3.44.0-9.el7_7, nss-softokn-freebl-devel-3.44.0-9.el7_7
Red Hat Enterprise Linux Server EUS (v. 7.7) nss-softokn-3.44.0-9.el7_7, nss-softokn-3.44.0-9.el7_7.ppc, nss-softokn-devel-3.44.0-9.el7_7 +5

TI-2019-12689 CVE-2019-17006 · GHSA-h4cr-x49j-2r7w

MEDIUM 48

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03558 Published 2020-10-22 Partial fix · 3.46 CWE-119

TI-2020-09921 CVE-2020-12403 · GHSA-9h25-47mw-52hh

MEDIUM 42

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01541 Published 2021-05-27 Partial fix CWE-125

TI-2019-08813 CVE-2019-11756 · GHSA-v78f-65qq-96m8

MEDIUM 41

Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01494 Published 2020-01-08 Partial fix · 71 CWE-416