Lucene search

K
oraclelinuxOracleLinuxELSA-2024-12337
HistoryApr 19, 2024 - 12:00 a.m.

nss security update

2024-04-1900:00:00
linux.oracle.com
4
nss security
fips package
ecc
p256
p384
p521
constant time
fips review
expired certs
cve-2023-5388
unix

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

20.6%

[3.90.0-6_fips]

  • Add FIPS package change: add fips suffix to Release and
    set Epoch to 10 [Orabug: 35862190]
  • Update FIPS module name for Oracle Linux [Orabug: 35862190]
    [3.90.0-6]
  • Fix ecc DER wrapping.
    [3.90.0-5]
  • Pick up validated constant time implementations of p256, p384, and p521
    from upsream
  • More Fips indicator changes
    [3.90.0-4]
  • FIPS review changes
  • add PORT_SafeZero to avoid compiler optimizing a way zeroing memory.
  • update the indicators for this release
  • allow hashing of longer than int32 values in a single PKCS #11 call.
    [3.90.0-3.3]
  • Fix expired certs in tests
  • Fix CVE-2023-5388

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

20.6%