nss-3.36.0-7.el7

エラータID: AXSA:2018-3341:02

Release date: 
Thursday, September 27, 2018 - 11:36
Subject: 
nss-3.36.0-7.el7
Affected Channels: 
Asianux Server 7 for x86_64
Severity: 
Moderate
Description: 

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es):

* nss: ServerHello.random is all zeros when handling a v2-compatible ClientHello (CVE-2018-12384)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Asianux would like to thank the Mozilla project for reporting this issue.

CVE-2018-12384
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be provided.

Solution: 

Update packages.

CVEs: 
CVE-2018-12384
When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
Additional Info: 

N/A

Download: 

SRPMS
  1. nss-3.36.0-7.el7.src.rpm
    MD5: 70c852d932fbb2333eafb3e7d94c4d66
    SHA-256: 3da94a6a7e50fd36bbb785c842d043e9c7870827ffe546b60a05c799a4f3f909
    Size: 22.27 MB

Asianux Server 7 for x86_64
  1. nss-3.36.0-7.el7.x86_64.rpm
    MD5: f34871f99bedb41975d4195760750f50
    SHA-256: f1399c35b72ac12e107885ce44043eef9722c5d4b85952817caec32a2ac1425b
    Size: 833.96 kB
  2. nss-devel-3.36.0-7.el7.x86_64.rpm
    MD5: 76bf6e34055b90f94fa6984a107ec7a2
    SHA-256: 35d3d9da00f3c366a1c7b6147caa6ce86584a64935bdd9c6db2129367ed12d7a
    Size: 227.27 kB
  3. nss-sysinit-3.36.0-7.el7.x86_64.rpm
    MD5: a95832dd144e52b186ef3b9b5b500125
    SHA-256: b9545c6b2a90e8365ef4dcd8f7694697b98274884ad79bf2641cc4ef768107e0
    Size: 61.27 kB
  4. nss-tools-3.36.0-7.el7.x86_64.rpm
    MD5: 92079d95a1d1829b065a3d10b71465aa
    SHA-256: 7d7729e21497716b31e9e3578f835cb5709dbc23ed7d09b605cdd3c9a17c18fe
    Size: 513.64 kB
  5. nss-3.36.0-7.el7.i686.rpm
    MD5: a95fa88c40ddab75127edc05b275a2e0
    SHA-256: 1c0e04bea680cdb134f7800de0fdd29737da3cc642d49b43389ee9825eeef534
    Size: 833.87 kB
  6. nss-devel-3.36.0-7.el7.i686.rpm
    MD5: 214a7c2bb33ee26fb7069bb8eff65292
    SHA-256: 17bff62d653d5ab64b7c0059ab339da5e5dede27b324dd02ee48955405404d23
    Size: 228.71 kB