SB20201110102 - openEuler 20.03 LTS update for nss 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20201110102

SB20201110102 - openEuler 20.03 LTS update for nss

Published: November 10, 2020

Security Bulletin ID SB20201110102
Severity
Low
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Cryptographic issues (CVE-ID: CVE-2020-6829)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of wNAF point multiplication algorithm when performing EC scalar point multiplication, which leaked partial information about the nonce used during signature generation. A remote attacker can perform an electro-magnetic side-channel attack and recover the private key.


2) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2020-12400)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists in Mozilla NSS library in the way P-384 and P-521 curves are used in the generation of EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key.


3) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2020-12401)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to usage of ECDSA signatures. A local user can perform a side channel attack and gain access to sensitive information.


Remediation

Install update from vendor's website.

References