SB2020081036 - Ubuntu update for nss

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2020-12400)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists in Mozilla NSS library in the way P-384 and P-521 curves are used in the generation of EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key.

2) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2020-12401)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to usage of ECDSA signatures. A local user can perform a side channel attack and gain access to sensitive information.

3) Cryptographic issues (CVE-ID: CVE-2020-6829)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of wNAF point multiplication algorithm when performing EC scalar point multiplication, which leaked partial information about the nonce used during signature generation. A remote attacker can perform an electro-magnetic side-channel attack and recover the private key.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-4455-1