nss security update

CentOS Errata and Security Advisory CESA-2015:1185

Network Security Services (NSS) is a set of libraries designed to support
cross-platform development of security-enabled client and server
applications.

A flaw was found in the way the TLS protocol composes the Diffie-Hellman
(DH) key exchange. A man-in-the-middle attacker could use this flaw to
force the use of weak 512 bit export-grade keys during the key exchange,
allowing them do decrypt all traffic. (CVE-2015-4000)

Note: This update forces the TLS/SSL client implementation in NSS to
reject DH key sizes below 768 bits, which prevents sessions to be
downgraded to export-grade keys. Future updates may raise this limit to
1024 bits.

The nss and nss-util packages have been upgraded to upstream versions
3.19.1. The upgraded versions provide a number of bug fixes and
enhancements over the previous versions.

Users of nss and nss-util are advised to upgrade to these updated packages,
which fix these security flaws, bugs, and add these enhancements.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2015-June/083381.html
https://lists.centos.org/pipermail/centos-announce/2015-June/083382.html
https://lists.centos.org/pipermail/centos-announce/2015-June/083384.html
https://lists.centos.org/pipermail/centos-announce/2015-June/083385.html

Affected packages:
nss
nss-devel
nss-pkcs11-devel
nss-sysinit
nss-tools
nss-util
nss-util-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2015:1185