-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: nss-softokn security update Advisory ID: RHSA-2020:1267-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:1267 Issue date: 2020-04-01 CVE Names: CVE-2018-0495 CVE-2019-11745 ==================================================================== 1. Summary: An update for nss-softokn is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) - x86_64 Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) - x86_64 Red Hat Enterprise Linux Server EUS (v. 7.5) - ppc64, ppc64le, s390x, x86_64 3. Description: The nss-softokn package provides the Network Security Services Softoken Cryptographic Module. Security Fix(es): * nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate (CVE-2019-11745) * ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1591163 - CVE-2018-0495 ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries 1774831 - CVE-2019-11745 nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate 6. Package List: Red Hat Enterprise Linux ComputeNode EUS (v. 7.5): Source: nss-softokn-3.36.0-6.el7_5.src.rpm x86_64: nss-softokn-3.36.0-6.el7_5.i686.rpm nss-softokn-3.36.0-6.el7_5.x86_64.rpm nss-softokn-debuginfo-3.36.0-6.el7_5.i686.rpm nss-softokn-debuginfo-3.36.0-6.el7_5.x86_64.rpm nss-softokn-freebl-3.36.0-6.el7_5.i686.rpm nss-softokn-freebl-3.36.0-6.el7_5.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5): x86_64: nss-softokn-debuginfo-3.36.0-6.el7_5.i686.rpm nss-softokn-debuginfo-3.36.0-6.el7_5.x86_64.rpm nss-softokn-devel-3.36.0-6.el7_5.i686.rpm nss-softokn-devel-3.36.0-6.el7_5.x86_64.rpm nss-softokn-freebl-devel-3.36.0-6.el7_5.i686.rpm nss-softokn-freebl-devel-3.36.0-6.el7_5.x86_64.rpm Red Hat Enterprise Linux Server EUS (v. 7.5): Source: nss-softokn-3.36.0-6.el7_5.src.rpm ppc64: nss-softokn-3.36.0-6.el7_5.ppc.rpm nss-softokn-3.36.0-6.el7_5.ppc64.rpm nss-softokn-debuginfo-3.36.0-6.el7_5.ppc.rpm nss-softokn-debuginfo-3.36.0-6.el7_5.ppc64.rpm nss-softokn-devel-3.36.0-6.el7_5.ppc.rpm nss-softokn-devel-3.36.0-6.el7_5.ppc64.rpm nss-softokn-freebl-3.36.0-6.el7_5.ppc.rpm nss-softokn-freebl-3.36.0-6.el7_5.ppc64.rpm nss-softokn-freebl-devel-3.36.0-6.el7_5.ppc.rpm nss-softokn-freebl-devel-3.36.0-6.el7_5.ppc64.rpm ppc64le: nss-softokn-3.36.0-6.el7_5.ppc64le.rpm nss-softokn-debuginfo-3.36.0-6.el7_5.ppc64le.rpm nss-softokn-devel-3.36.0-6.el7_5.ppc64le.rpm nss-softokn-freebl-3.36.0-6.el7_5.ppc64le.rpm nss-softokn-freebl-devel-3.36.0-6.el7_5.ppc64le.rpm s390x: nss-softokn-3.36.0-6.el7_5.s390.rpm nss-softokn-3.36.0-6.el7_5.s390x.rpm nss-softokn-debuginfo-3.36.0-6.el7_5.s390.rpm nss-softokn-debuginfo-3.36.0-6.el7_5.s390x.rpm nss-softokn-devel-3.36.0-6.el7_5.s390.rpm nss-softokn-devel-3.36.0-6.el7_5.s390x.rpm nss-softokn-freebl-3.36.0-6.el7_5.s390.rpm nss-softokn-freebl-3.36.0-6.el7_5.s390x.rpm nss-softokn-freebl-devel-3.36.0-6.el7_5.s390.rpm nss-softokn-freebl-devel-3.36.0-6.el7_5.s390x.rpm x86_64: nss-softokn-3.36.0-6.el7_5.i686.rpm nss-softokn-3.36.0-6.el7_5.x86_64.rpm nss-softokn-debuginfo-3.36.0-6.el7_5.i686.rpm nss-softokn-debuginfo-3.36.0-6.el7_5.x86_64.rpm nss-softokn-devel-3.36.0-6.el7_5.i686.rpm nss-softokn-devel-3.36.0-6.el7_5.x86_64.rpm nss-softokn-freebl-3.36.0-6.el7_5.i686.rpm nss-softokn-freebl-3.36.0-6.el7_5.x86_64.rpm nss-softokn-freebl-devel-3.36.0-6.el7_5.i686.rpm nss-softokn-freebl-devel-3.36.0-6.el7_5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-0495 https://access.redhat.com/security/cve/CVE-2019-11745 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXoRSIdzjgjWX9erEAQiVqQ//TH1K6R0uTAuq11Q7PXmGjTPUa2/clEuk c008m2G1x4AWmPocvtPpPhKe0BUviGxFtAGTrhJx5f2be2YmRZ+JHFRYwHI3lKM2 YJjMwSW0vohBhVXudOvG7+cWfbkKt1i0a8N+2IaSH0VcgUEOvhyPVZ/22HwNUeaS loPZFyJOJZy76heQNzenvXLj1CRIlkGsxsvr0fxVHqNrNXn/k3jzPfBHtFxbawk1 QjwkAND/s8x9Qj8T7zby/2NXXi5y8yuI4PksOb2rmyjaPLtcAGujHtHsEGziyinW BJAyh7tkMxAcWxxMNEdRAZjVcErp99ZNaa4Ck+u9rEW7vPWYn6EunPnqnL1y9nCZ f/ZKICjXVkMqZq8Jp7WOmupmT1fGt1LSUYnJIiyn1u/6fZANh6BzgmR74RkX5OWc 2QSyU3FcZXT7ttaKtaGslCaT9ZLIn1grKhoTrqTrc1Z9IekJNBBm/5/FIzutNqd/ D6TIJbH82G03j1DXG2fvsRLfaDu0GTt6HXLEsK0JPlJZeXOwJdrGvJz3XYX1jo2o CF1R9lEXhkJXoxXn7e5EJ5Egl04vqqJ16qsWyynolhETK/dUkXf1x4Cdg3HeZ3CB m1EgllecBP+OLntAqaHihCzwpZEJaARI/xxKHpYd96KcsfqLtPKcc1uWDFHk64Tk rIqDkBJPd4A=xNcH -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce