4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
3.4 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
0.975 High
EPSS
Percentile
100.0%
CentOS Errata and Security Advisory CESA-2014:1948
Network Security Services (NSS) is a set of libraries designed to support
the cross-platform development of security-enabled client and server
applications. Netscape Portable Runtime (NSPR) provides platform
independence for non-GUI operating system facilities.
This update adds support for the TLS Fallback Signaling Cipher Suite Value
(TLS_FALLBACK_SCSV), which can be used to prevent protocol downgrade
attacks against applications which re-connect using a lower SSL/TLS
protocol version when the initial connection indicating the highest
supported protocol version fails.
This can prevent a forceful downgrade of the communication to SSL 3.0.
The SSL 3.0 protocol was found to be vulnerable to the padding oracle
attack when using block cipher suites in cipher block chaining (CBC) mode.
This issue is identified as CVE-2014-3566, and also known under the alias
POODLE. This SSL 3.0 protocol flaw will not be addressed in a future
update; it is recommended that users configure their applications to
require at least TLS protocol version 1.0 for secure communication.
For additional information about this flaw, see the Knowledgebase article
at https://access.redhat.com/articles/1232123
The nss, nss-util, and nss-softokn packages have been upgraded to upstream
version 3.16.2.3, which provides a number of bug fixes and enhancements
over the previous version, and adds the support for Mozilla Firefox 31.3.
(BZ#1158159, BZ#1165003, BZ#1165525)
Users of nss, nss-util, and nss-softokn are advised to upgrade to these
updated packages, which contain a backported patch to mitigate the
CVE-2014-3566 issue, fix these bugs, and add these enhancements. After
installing this update, applications using NSS or NSPR must be restarted
for this update to take effect.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2014-December/082957.html
https://lists.centos.org/pipermail/centos-announce/2014-December/082962.html
https://lists.centos.org/pipermail/centos-announce/2014-December/082964.html
Affected packages:
nss
nss-devel
nss-pkcs11-devel
nss-softokn
nss-softokn-devel
nss-softokn-freebl
nss-softokn-freebl-devel
nss-sysinit
nss-tools
nss-util
nss-util-devel
Upstream details at:
https://access.redhat.com/errata/RHSA-2014:1948
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 5 | i386 | nss | < 3.16.2.3-1.el5_11 | nss-3.16.2.3-1.el5_11.i386.rpm |
CentOS | 5 | i386 | nss-devel | < 3.16.2.3-1.el5_11 | nss-devel-3.16.2.3-1.el5_11.i386.rpm |
CentOS | 5 | i386 | nss-pkcs11-devel | < 3.16.2.3-1.el5_11 | nss-pkcs11-devel-3.16.2.3-1.el5_11.i386.rpm |
CentOS | 5 | i386 | nss-tools | < 3.16.2.3-1.el5_11 | nss-tools-3.16.2.3-1.el5_11.i386.rpm |
CentOS | 5 | i386 | nss | < 3.16.2.3-1.el5_11 | nss-3.16.2.3-1.el5_11.i386.rpm |
CentOS | 5 | x86_64 | nss | < 3.16.2.3-1.el5_11 | nss-3.16.2.3-1.el5_11.x86_64.rpm |
CentOS | 5 | i386 | nss-devel | < 3.16.2.3-1.el5_11 | nss-devel-3.16.2.3-1.el5_11.i386.rpm |
CentOS | 5 | x86_64 | nss-devel | < 3.16.2.3-1.el5_11 | nss-devel-3.16.2.3-1.el5_11.x86_64.rpm |
CentOS | 5 | i386 | nss-pkcs11-devel | < 3.16.2.3-1.el5_11 | nss-pkcs11-devel-3.16.2.3-1.el5_11.i386.rpm |
CentOS | 5 | x86_64 | nss-pkcs11-devel | < 3.16.2.3-1.el5_11 | nss-pkcs11-devel-3.16.2.3-1.el5_11.x86_64.rpm |
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
3.4 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
0.975 High
EPSS
Percentile
100.0%