nspr, nss security update

CentOS Errata and Security Advisory CESA-2019:2237

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

The following packages have been upgraded to a later upstream version: nss (3.44.0), nss-softokn (3.44.0), nss-util (3.44.0), nspr (4.21.0). (BZ#1645231, BZ#1692269, BZ#1692271, BZ#1692274)

Security Fix(es):

• ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)

• nss: Cache side-channel variant of the Bleichenbacher attack (CVE-2018-12404)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2019-August/032281.html
https://lists.centos.org/pipermail/centos-cr-announce/2019-August/032282.html
https://lists.centos.org/pipermail/centos-cr-announce/2019-August/032284.html
https://lists.centos.org/pipermail/centos-cr-announce/2019-August/032285.html

Affected packages:
nspr
nspr-devel
nss
nss-devel
nss-pkcs11-devel
nss-softokn
nss-softokn-devel
nss-softokn-freebl
nss-softokn-freebl-devel
nss-sysinit
nss-tools
nss-util
nss-util-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2019:2237