Описание
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| firefox | fixed | 124.0-1 | package | |
| firefox-esr | fixed | 115.9.0esr-1 | package | |
| nss | fixed | 2:3.98-1 | package | |
| nss | ignored | bookworm | package | |
| nss | no-dsa | bullseye | package | |
| thunderbird | fixed | 1:115.9.0-1 | package |
Примечания
https://people.redhat.com/~hkario/marvin/
Vendor patch (Rocky Linux, not upstreamed): https://git.rockylinux.org/staging/rpms/nss/-/commit/1f7f7523b61a2ada2f461548c4160fbbf979c5dd
Fixed by: https://hg.mozilla.org/projects/nss/rev/196716d8377ab427e326f20bff2d026e90ac69e2
https://www.mozilla.org/en-US/security/advisories/mfsa2024-12/#CVE-2023-5388
https://www.mozilla.org/en-US/security/advisories/mfsa2024-13/#CVE-2023-5388
https://www.mozilla.org/en-US/security/advisories/mfsa2024-14/#CVE-2023-5388
Связанные уязвимости
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
