RHSA-2014:1307

Affecting nss-tools package, versions <0:3.16.2-7.el7_0

Report new vulnerabilities
high severity
Do your applications use this vulnerable package? Test your applications

Overview

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A flaw was found in the way NSS parsed ASN.1 (Abstract Syntax Notation One) input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS. (CVE-2014-1568) Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Antoine Delignat-Lavaud and Intel Product Security Incident Response Team as the original reporters. All NSS users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, applications using NSS must be restarted for this update to take effect.

CVE
RHSA-2014:1307
Snyk ID
SNYK-CENTOS7-NSSTOOLS-321527
Published
27 Jun, 2018