<p>Upgrade <code>Centos:7</code> <code>nss-sysinit</code> to version 0:3.21.3-2.el7_3 or higher.</p>

Key Management Errors Affecting nss-sysinit package, versions <0:3.21.3-2.el7_3

Snyk CVSS

Attack Complexity Low

Threat Intelligence

EPSS 0.19% (57^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-CENTOS7-NSSSYSINIT-2075950
published 26 Jul 2021
disclosed 16 Nov 2016

Report a new vulnerability Found a mistake?

Introduced: 16 Nov 2016

CVE-2016-8635 Open this link in a new tab CWE-320 Open this link in a new tab

How to fix?

Upgrade Centos:7 nss-sysinit to version 0:3.21.3-2.el7_3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nss-sysinit package and not the nss-sysinit package as distributed by Centos. See How to fix? for Centos:7 relevant fixed versions and status.

It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.