Headline
Red Hat Security Advisory 2023-1332-01
Red Hat Security Advisory 2023-1332-01 - Network Security Services is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Important: nss security update
Advisory ID: RHSA-2023:1332-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1332
Issue date: 2023-03-20
CVE Names: CVE-2023-0767
====================================================================
- Summary:
An update for nss is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
- Description:
Network Security Services (NSS) is a set of libraries designed to support
the cross-platform development of security-enabled client and server
applications.
Security Fix(es):
- nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, applications using NSS (for example, Firefox)
must be restarted for this update to take effect.
- Bugs fixed (https://bugzilla.redhat.com/):
2170377 - CVE-2023-0767 nss: Arbitrary memory write via PKCS 12
- Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
nss-3.79.0-5.el7_9.src.rpm
x86_64:
nss-3.79.0-5.el7_9.i686.rpm
nss-3.79.0-5.el7_9.x86_64.rpm
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-sysinit-3.79.0-5.el7_9.x86_64.rpm
nss-tools-3.79.0-5.el7_9.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64:
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-devel-3.79.0-5.el7_9.i686.rpm
nss-devel-3.79.0-5.el7_9.x86_64.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.i686.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
nss-3.79.0-5.el7_9.src.rpm
x86_64:
nss-3.79.0-5.el7_9.i686.rpm
nss-3.79.0-5.el7_9.x86_64.rpm
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-sysinit-3.79.0-5.el7_9.x86_64.rpm
nss-tools-3.79.0-5.el7_9.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64:
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-devel-3.79.0-5.el7_9.i686.rpm
nss-devel-3.79.0-5.el7_9.x86_64.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.i686.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
nss-3.79.0-5.el7_9.src.rpm
ppc64:
nss-3.79.0-5.el7_9.ppc.rpm
nss-3.79.0-5.el7_9.ppc64.rpm
nss-debuginfo-3.79.0-5.el7_9.ppc.rpm
nss-debuginfo-3.79.0-5.el7_9.ppc64.rpm
nss-devel-3.79.0-5.el7_9.ppc.rpm
nss-devel-3.79.0-5.el7_9.ppc64.rpm
nss-sysinit-3.79.0-5.el7_9.ppc64.rpm
nss-tools-3.79.0-5.el7_9.ppc64.rpm
ppc64le:
nss-3.79.0-5.el7_9.ppc64le.rpm
nss-debuginfo-3.79.0-5.el7_9.ppc64le.rpm
nss-devel-3.79.0-5.el7_9.ppc64le.rpm
nss-sysinit-3.79.0-5.el7_9.ppc64le.rpm
nss-tools-3.79.0-5.el7_9.ppc64le.rpm
s390x:
nss-3.79.0-5.el7_9.s390.rpm
nss-3.79.0-5.el7_9.s390x.rpm
nss-debuginfo-3.79.0-5.el7_9.s390.rpm
nss-debuginfo-3.79.0-5.el7_9.s390x.rpm
nss-devel-3.79.0-5.el7_9.s390.rpm
nss-devel-3.79.0-5.el7_9.s390x.rpm
nss-sysinit-3.79.0-5.el7_9.s390x.rpm
nss-tools-3.79.0-5.el7_9.s390x.rpm
x86_64:
nss-3.79.0-5.el7_9.i686.rpm
nss-3.79.0-5.el7_9.x86_64.rpm
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-devel-3.79.0-5.el7_9.i686.rpm
nss-devel-3.79.0-5.el7_9.x86_64.rpm
nss-sysinit-3.79.0-5.el7_9.x86_64.rpm
nss-tools-3.79.0-5.el7_9.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64:
nss-debuginfo-3.79.0-5.el7_9.ppc.rpm
nss-debuginfo-3.79.0-5.el7_9.ppc64.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.ppc.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.ppc64.rpm
ppc64le:
nss-debuginfo-3.79.0-5.el7_9.ppc64le.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.ppc64le.rpm
s390x:
nss-debuginfo-3.79.0-5.el7_9.s390.rpm
nss-debuginfo-3.79.0-5.el7_9.s390x.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.s390.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.s390x.rpm
x86_64:
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.i686.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
nss-3.79.0-5.el7_9.src.rpm
x86_64:
nss-3.79.0-5.el7_9.i686.rpm
nss-3.79.0-5.el7_9.x86_64.rpm
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-devel-3.79.0-5.el7_9.i686.rpm
nss-devel-3.79.0-5.el7_9.x86_64.rpm
nss-sysinit-3.79.0-5.el7_9.x86_64.rpm
nss-tools-3.79.0-5.el7_9.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64:
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.i686.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2023-0767
https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZBh4d9zjgjWX9erEAQi0VA/9EDOjHMY594bv+AZ4cg4w1wAKFyh+3m+j
jyOn0aHNkLFAXyHixGKeANhURkvQ6MG2CWVz/2idzPWvrVBMAmN26OXOJI7MmOve
AZPPt+kK83ec+PAdNLRKDWlMXx/C7YxIDlMolC3vsHs8GFOh07sQSl+qCgCUsoqL
wULhFZoxfjvMRM7PNsXYrjWhOQkbCZYudbp3sXhWXNcMFGttR2I51f0AVWvVl1P1
JPwVBlEK0EphYWNncr2zQphP6zWLPyl0B0o+7O/M5a/bkXrAN13ShHv8N06Rmxry
XFWJTk9DyPQljYK2dYJjo0N/9zDKouXwdTxuwoxPYhrFgsy+VKEFp47oFUlrzLB6
x5pdDarqpdcOkPFNZuRjuBw2RbMozWkoy+JajW7NXFz3XYZky9B95RZSNI2lHhdQ
cwqJ2aZSAgOJMexcxPxkiwkE4l2V82yYBEHgkf2/6/HZSoYCFZtYJKF5miPaMNYY
nhbc2w6Z3aQ78C5jS9wqdVsJsCpVPflwRq8FXUO0bAB91VG/GvqAIdH/VhxAlXy5
5h2g/skrFCTAR9iKE4AWm5uk1mPN/tTQa7eHY7fx/fA3cTm46Jd/5am0w8IhZHoq
I1X6fJzE3WMg4AZ6y/BAiVSTxolLhepNy3zdCP8cpyK+aMDipPimw8rddTayiEaU
1y2vLw5oCe4=ZIU4
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Gentoo Linux Security Advisory 202305-35 - Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. Versions greater than or equal to 102.10.0:esr are affected.
Red Hat Security Advisory 2023-2061-01 - Multicluster Engine for Kubernetes 2.1.6 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy. Issues addressed include a denial of service vulnerability.
An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-23521: A flaw was found in Git, a distributed revision control system. When parsing gitattributes, a mechanism to allow defining attributes for paths, multiple integer overflows can occur when there is a huge number of path patterns, attributes for a single pattern, ...
Red Hat Security Advisory 2023-1392-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.10.55.
Red Hat Security Advisory 2023-1406-01 - Network Security Services is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.
An update for nss is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0767: The Mozilla Foundation Security Advisory describes this flaw as: An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled.
Red Hat Security Advisory 2023-0817-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.8.0. Issues addressed include a use-after-free vulnerability.
Red Hat Security Advisory 2023-0824-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.8.0. Issues addressed include a use-after-free vulnerability.
Debian Linux Security Advisory 5355-1 - Multiple security issues were discovered in Thunderbird, which could result in denial of service or the execution of arbitrary code.
Debian Linux Security Advisory 5353-1 - Christian Holler discovered that incorrect handling of PKCS 12 Safe Bag attributes in nss, the Mozilla Network Security Service library, may result in execution of arbitrary code if a specially crafted PKCS 12 certificate bundle is processed.
An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0616: The Mozilla Foundation Security Advisory describes this flaw as: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacke...
An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0616: The Mozilla Foundation Security Advisory describes this flaw as: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacker could send a crafted mes...
An update for thunderbird is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0616: The Mozilla Foundation Security Advisory describes this flaw as: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacke...
An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0616: The Mozilla Foundation Security Advisory describes this flaw as: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and di...
An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0767: The Mozilla Foundation Security Advisory describes this flaw as: An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. * CVE-2023-25728: The Mozilla Foundation Security Advisory describes this flaw as: The `Content-Security-Policy-Report-Only`...