Use of a broken or risky cryptographic algorithm in Mozilla NSS - CVE-2020-12401

Vulnerability identifier: #VU45798

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12401

CWE-ID: CWE-327

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to usage of ECDSA signatures. A local user can perform a side channel attack and gain access to sensitive information.

Mozilla NSS
Amazon Linux AMI
Gentoo Linux
F5OS
Red Hat Enterprise Linux Server
CentOS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Ubuntu
openEuler
Fedora
Ansible Automation Platform
nss (Alpine package)
firefox (Alpine package)
libnss3 (Ubuntu package)
nss-util (Red Hat package)
nss (Red Hat package)
nss-softokn (Red Hat package)
nss
nss-softokn-devel
nss-util-devel
nss-softokn
nss-util
nss-devel
nss-debugsource
nss-help
nss-debuginfo
nspr (Red Hat package)
firefox (Ubuntu package)
Traffix SDC
Red Hat OpenShift Container Platform
Firefox for Android
Data Computing Appliance (DCA)
Dell Data Protection Central

Install updates from vendor's website.

Mozilla NSS - update to 3.55
Ansible Automation Platform - addressed in versions 1.0, 1.1, 1.2.4
Firefox for Android - update to 80.1.2
Data Computing Appliance (DCA) - addressed in versions Firmware tool 3H00, 4.2.1.0
libnss3 (Ubuntu package) - addressed in versions 2:3.28.4-0ubuntu0.12.04.10, 2:3.28.4-0ubuntu0.16.04.13, 2:3.35-2ubuntu2.11, 2:3.49.1-1ubuntu1.4
nss-util (Red Hat package) - update to 3.53.1-1.el7_9
nss (Red Hat package) - update to 3.53.1-3.el7_9
nss-softokn (Red Hat package) - update to 3.53.1-6.el7_9
nss - update to 3.54.0-2
nss-softokn-devel - update to 3.54.0-2
nss-util-devel - update to 3.54.0-2
nss-softokn - update to 3.54.0-2
nss-util - update to 3.54.0-2
nss-devel - update to 3.54.0-2
nss-debugsource - update to 3.54.0-2
nss-help - update to 3.54.0-2
nss-debuginfo - update to 3.54.0-2
nss - addressed in versions 3.55.0-1.fc31, 3.55.0-1.fc32
Red Hat OpenShift Container Platform - update to 4.3.40
nspr (Red Hat package) - update to 4.25.0-2.el7_9
Dell Data Protection Central - update to 19.9
firefox (Ubuntu package) - addressed in versions 80.0+build2-0ubuntu0.16.04.1, 80.0+build2-0ubuntu0.18.04.1, 80.0+build2-0ubuntu0.20.04.1, 80.0.1+build1-0ubuntu0.16.04.1, 80.0.1+build1-0ubuntu0.18.04.1, 80.0.1+build1-0ubuntu0.20.04.1

• https://security.gentoo.org/glsa/202008-08
• https://access.redhat.com/security/cve/cve-2020-12401

• Multiple vulnerabilities in Mozilla Network Security Service (NSS)
• Gentoo update for Mozilla Network Security Service (NSS)
• Use of a broken or risky cryptographic algorithm in nss (Alpine package)
• Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
• Use of a broken or risky cryptographic algorithm in firefox (Alpine package)
• Multiple vulnerabilities in Firefox for Android
• Red Hat Enterprise Linux 7 update for nss and nspr
• Multiple vulnerabilities in NSS component in F5OS and Traffix SDC
• CentOS 7 update for nss
• Amazon Linux AMI update for nspr, nss-softokn, nss-util
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 1.2
• Multiple vulnerabilities in Dell Data Protection Central
• openEuler 20.03 LTS update for nss
• Ubuntu update for nss
• Ubuntu update for firefox
• Ubuntu update for firefox
• Multiple vulnerabilities in Ansible Automation Platform 1.0 packages
• Multiple vulnerabilities in Ansible Automation Platform 1.1 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.3
• Fedora 32 update for nss
• Fedora 31 update for nss