Network Security Services (NSS) is a set of libraries designed to support
cross-platform development of security-enabled client and server
applications.
A flaw was found in the way the TLS protocol composes the Diffie-Hellman
(DH) key exchange. A man-in-the-middle attacker could use this flaw to
force the use of weak 512 bit export-grade keys during the key exchange,
allowing them do decrypt all traffic. (CVE-2015-4000)
Note: This update forces the TLS/SSL client implementation in NSS to
reject DH key sizes below 768 bits, which prevents sessions to be
downgraded to export-grade keys. Future updates may raise this limit to
1024 bits.
The nss and nss-util packages have been upgraded to upstream versions
3.19.1. The upgraded versions provide a number of bug fixes and
enhancements over the previous versions.
Users of nss and nss-util are advised to upgrade to these updated packages,
which fix these security flaws, bugs, and add these enhancements.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | 7 | s390x | nss | < 3.19.1-3.el7_1 | nss-3.19.1-3.el7_1.s390x.rpm |
RedHat | 7 | x86_64 | nss-sysinit | < 3.19.1-3.el7_1 | nss-sysinit-3.19.1-3.el7_1.x86_64.rpm |
RedHat | 6 | ppc64 | nss-devel | < 3.19.1-3.el6_6 | nss-devel-3.19.1-3.el6_6.ppc64.rpm |
RedHat | 6 | s390 | nss-pkcs11-devel | < 3.19.1-3.el6_6 | nss-pkcs11-devel-3.19.1-3.el6_6.s390.rpm |
RedHat | 6 | ppc64 | nss-debuginfo | < 3.19.1-3.el6_6 | nss-debuginfo-3.19.1-3.el6_6.ppc64.rpm |
RedHat | 7 | ppc | nss-util | < 3.19.1-1.el7_1 | nss-util-3.19.1-1.el7_1.ppc.rpm |
RedHat | 6 | ppc64 | nss-pkcs11-devel | < 3.19.1-3.el6_6 | nss-pkcs11-devel-3.19.1-3.el6_6.ppc64.rpm |
RedHat | 6 | x86_64 | nss-util | < 3.19.1-1.el6_6 | nss-util-3.19.1-1.el6_6.x86_64.rpm |
RedHat | 7 | i686 | nss-util-devel | < 3.19.1-1.el7_1 | nss-util-devel-3.19.1-1.el7_1.i686.rpm |
RedHat | 6 | ppc | nss-util-debuginfo | < 3.19.1-1.el6_6 | nss-util-debuginfo-3.19.1-1.el6_6.ppc.rpm |