==========================================================================
Ubuntu Security Notice USN-4397-1
June 16, 2020

nss vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 20.04 LTS
– Ubuntu 19.10
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in NSS.

Software Description:
– nss: Network Security Service library

Details:

It was discovered that NSS incorrectly handled the TLS State Machine. A
remote attacker could possibly use this issue to cause NSS to hang,
resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.10. (CVE-2019-17023)

Cesar Pereida Garcia discovered that NSS incorrectly handled DSA key
generation. A local attacker could possibly use this issue to perform a
timing attack and recover DSA keys. (CVE-2020-12399)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
libnss3 2:3.49.1-1ubuntu1.1

Ubuntu 19.10:
libnss3 2:3.45-1ubuntu2.3

Ubuntu 18.04 LTS:
libnss3 2:3.35-2ubuntu2.8

Ubuntu 16.04 LTS:
libnss3 2:3.28.4-0ubuntu0.16.04.11

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
https://usn.ubuntu.com/4397-1
CVE-2019-17023, CVE-2020-12399

Package Information:
https://launchpad.net/ubuntu/+source/nss/2:3.49.1-1ubuntu1.1
https://launchpad.net/ubuntu/+source/nss/2:3.45-1ubuntu2.3
https://launchpad.net/ubuntu/+source/nss/2:3.35-2ubuntu2.8
https://launchpad.net/ubuntu/+source/nss/2:3.28.4-0ubuntu0.16.04.11

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl7pCu0ACgkQZWnYVadE
vpNjAw//cV9TL1FYL4sO3z6GtFwEMnrFaFH8tw8paVH1j9qd0PKUF8u+rGZ5wUYa
UXMF/TXDoNSeW066sNENzID3kTZx5ETcdbWPfifZnuWOe5+kSBA3bMH+xxlibJLE
nzS051wn9Sr9jhiElSptdNaB/2/3kn6ZO2wV3n9j7QXVBNNEQj1hI4i2IZQdcvGe
m6y6SyBGtoN3QrjB7jeXmPAh7DWTNpflFuIghc3AwClaajFeVMZtgTIwD9P+0h4K
/LEJJOO93oFTM6YA30t7LrkzSZfWCTsQSw48ZS2XWjgIJL1H6R2zOLbqoUEtL9q/
CMAoPlVvD8J7dSVjUOsKfYkk8zK43PMtYnQv+7eDL9ic/FWkR+16b4RJ/k2ChxFO
WO07+VxnRdPWwWuA2JYkEQ6BwupSG+i9qzg2dhYA0rjX+E9OnVdzRw1oTv+dKSIr
YVQaZgsQftLxfQWOFdd72ku8lhxqYcE1k4vkjA+2s+EZGJJ5Va587pDEo3Y02X6I
WqiefVN0wvpbm5hwBro24q7nYsES1ROWHzYAJDIfE+lPIpBCrCIEOwaNS6LgEp/2
NU54E0XiPzyau17rzESR/ek+Fo6G5VR4ED0Fw4rY8F05n8zez3a4fr56i9YxfRdz
uBrUFR5VBfcvlD0dEF3nhXrs5b/r0bbBIpaYVSGbxZeT6CRlhGQ=
=OzHm
—–END PGP SIGNATURE—–
—