Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat NSS Library Updates Fix Authentication and Encryption Flaws

published 2 years ago

Summary

Red Hat's NSS library has security updates to prevent potential authentication and encryption weaknesses. This affects systems using the affected library, potentially putting sensitive data at risk. Update the library to the latest version to maintain security and integrity.

What to do

Update redhat nspr to version 0:4.35.0-6.el9_3.
Update redhat nspr-debuginfo to version 0:4.35.0-6.el9_3.
Update redhat nspr-devel to version 0:4.35.0-6.el9_3.
Update redhat nss to version 0:3.90.0-6.el9_3.
Update redhat nss-debuginfo to version 0:3.90.0-6.el9_3.
Update redhat nss-debugsource to version 0:3.90.0-6.el9_3.
Update redhat nss-devel to version 0:3.90.0-6.el9_3.
Update redhat nss-softokn to version 0:3.90.0-6.el9_3.
Update redhat nss-softokn-debuginfo to version 0:3.90.0-6.el9_3.
Update redhat nss-softokn-devel to version 0:3.90.0-6.el9_3.
Update redhat nss-softokn-freebl to version 0:3.90.0-6.el9_3.
Update redhat nss-softokn-freebl-debuginfo to version 0:3.90.0-6.el9_3.
Update redhat nss-softokn-freebl-devel to version 0:3.90.0-6.el9_3.
Update redhat nss-sysinit to version 0:3.90.0-6.el9_3.
Update redhat nss-sysinit-debuginfo to version 0:3.90.0-6.el9_3.
Update redhat nss-tools to version 0:3.90.0-6.el9_3.
Update redhat nss-tools-debuginfo to version 0:3.90.0-6.el9_3.
Update redhat nss-util to version 0:3.90.0-6.el9_3.
Update redhat nss-util-debuginfo to version 0:3.90.0-6.el9_3.
Update redhat nss-util-devel to version 0:3.90.0-6.el9_3.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:9::appstream	redhat	nspr	< 0:4.35.0-6.el9_3 Fix: upgrade to 0:4.35.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nspr-debuginfo	< 0:4.35.0-6.el9_3 Fix: upgrade to 0:4.35.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nspr-devel	< 0:4.35.0-6.el9_3 Fix: upgrade to 0:4.35.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-debuginfo	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-debugsource	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-devel	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-softokn	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-softokn-debuginfo	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-softokn-devel	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-softokn-freebl	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-softokn-freebl-debuginfo	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-softokn-freebl-devel	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-sysinit	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-sysinit-debuginfo	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-tools	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-tools-debuginfo	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-util	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-util-debuginfo	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3
Red Hat:enterprise_linux:9::appstream	redhat	nss-util-devel	< 0:3.90.0-6.el9_3 Fix: upgrade to 0:3.90.0-6.el9_3

Original advisory text

Red Hat Security Advisory: nss security update

References

https://access.redhat.com/errata/RHSA-2024:0790 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2249906 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0790.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-6135 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-6135 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-6135 Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1853908 Third Party Advisory
https://minerva.crocs.fi.muni.cz/ Third Party Advisory
https://people.redhat.com/~hkario/marvin/ Third Party Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2023-56/#CVE-2023-6135 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.3 Medium

Timeline

Published16 Sep 2024

Updated23 Apr 2026

First seen23 Apr 2026

Sources

RHSA-2024:0790 · OSV

Track software like this

Free during beta