Use of a broken or risky cryptographic algorithm in Mozilla NSS - CVE-2020-12400

Vulnerability identifier: #VU45797

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12400

CWE-ID: CWE-327

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists in Mozilla NSS library in the way P-384 and P-521 curves are used in the generation of EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key.

Mozilla NSS
Amazon Linux AMI
Gentoo Linux
F5OS
Red Hat Enterprise Linux Desktop
CentOS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Ubuntu
openEuler
Fedora
Ansible Automation Platform
nss (Alpine package)
firefox (Alpine package)
libnss3 (Ubuntu package)
nss-util (Red Hat package)
nss (Red Hat package)
nss-softokn (Red Hat package)
nss-util
nss-debuginfo
nss-help
nss-debugsource
nss-devel
nss-softokn
nss-util-devel
nss-softokn-devel
nss
nspr (Red Hat package)
firefox (Ubuntu package)
Traffix SDC
Red Hat OpenShift Container Platform
Firefox for Android
Data Computing Appliance (DCA)

Install updates from vendor's website.

Mozilla NSS - update to 3.55
Ansible Automation Platform - addressed in versions 1.0, 1.1, 1.2.4
Firefox for Android - update to 80.1.2
Data Computing Appliance (DCA) - addressed in versions Firmware tool 3H00, 4.2.1.0
libnss3 (Ubuntu package) - addressed in versions 2:3.28.4-0ubuntu0.12.04.10, 2:3.28.4-0ubuntu0.16.04.13, 2:3.35-2ubuntu2.11, 2:3.49.1-1ubuntu1.4
nss-util (Red Hat package) - update to 3.53.1-1.el7_9
nss (Red Hat package) - addressed in versions 3.53.1-3.el7_9, 3.53.1-17.el8_3
nss-softokn (Red Hat package) - update to 3.53.1-6.el7_9
nss-util - update to 3.54.0-2
nss-debuginfo - update to 3.54.0-2
nss-help - update to 3.54.0-2
nss-debugsource - update to 3.54.0-2
nss-devel - update to 3.54.0-2
nss-softokn - update to 3.54.0-2
nss-util-devel - update to 3.54.0-2
nss-softokn-devel - update to 3.54.0-2
nss - update to 3.54.0-2
nss - addressed in versions 3.55.0-1.fc31, 3.55.0-1.fc32
Red Hat OpenShift Container Platform - update to 4.3.40
nspr (Red Hat package) - update to 4.25.0-2.el7_9
firefox (Ubuntu package) - addressed in versions 80.0+build2-0ubuntu0.16.04.1, 80.0+build2-0ubuntu0.18.04.1, 80.0+build2-0ubuntu0.20.04.1, 80.0.1+build1-0ubuntu0.16.04.1, 80.0.1+build1-0ubuntu0.18.04.1, 80.0.1+build1-0ubuntu0.20.04.1

• https://security.gentoo.org/glsa/202008-08
• https://access.redhat.com/security/cve/cve-2020-12400

• Multiple vulnerabilities in Mozilla Network Security Service (NSS)
• Gentoo update for Mozilla Network Security Service (NSS)
• Use of a broken or risky cryptographic algorithm in nss (Alpine package)
• Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
• Use of a broken or risky cryptographic algorithm in firefox (Alpine package)
• Multiple vulnerabilities in Firefox for Android
• Red Hat Enterprise Linux 7 update for nss and nspr
• Red Hat Enterprise Linux 8 update for nss
• Multiple vulnerabilities in NSS component in F5OS and Traffix SDC
• CentOS 7 update for nss
• Amazon Linux AMI update for nspr, nss-softokn, nss-util
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 1.2
• openEuler 20.03 LTS update for nss
• Ubuntu update for nss
• Ubuntu update for firefox
• Ubuntu update for firefox
• Multiple vulnerabilities in Ansible Automation Platform 1.0 packages
• Multiple vulnerabilities in Ansible Automation Platform 1.1 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.3
• Fedora 32 update for nss
• Fedora 31 update for nss