Red Hat Enterprise Linux 8.8 Extended Update Support update for nss



Published: 2024-02-12
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2023-6135
CWE-ID CWE-203
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Operating systems & Components / Operating system

Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Operating systems & Components / Operating system

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Operating systems & Components / Operating system

Red Hat Enterprise Linux for x86_64 - Extended Update Support
Operating systems & Components / Operating system

nss (Red Hat package)
Operating systems & Components / Operating system package or component

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Observable discrepancy

EUVDB-ID: #VU84568

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6135

CWE-ID: CWE-203 - Observable discrepancy

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a side-channel attack in multiple NSS NIST curves, known as "Minerva". A remote attacker can recover the private key and decrypt data passed between server and client.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.8

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.8

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.8

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.8

nss (Red Hat package): before 3.90.0-6.el8_8

External links

http://access.redhat.com/errata/RHSA-2024:0785


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###