SB2023012484 - SUSE update for mozilla-nss

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023012484

SB2023012484 - SUSE update for mozilla-nss

Published: January 24, 2023

Security Bulletin ID SB2023012484
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Insufficient verification of data authenticity (CVE-ID: CVE-2022-23491)

The vulnerability allows a remote attacker to bypass certificate validation checks.

The vulnerability exists due to presence of the TrustCor certificate in the Root Certificates list. the certificate is removed due to TrustCor's ownership also operated a business that produced spyware. Therefore, any checks that rely on digital signatures of trusted certificates were compromised.


2) Stack-based buffer overflow (CVE-ID: CVE-2022-3479)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the NSS_GetClientAuthData() function in /lib/ssl/authcert.c when accessing gnutls server without a user certificate in the database. A remote attacker can trigger a stack-based buffer overflow and crash the application using the affected library.


Remediation

Install update from vendor's website.

References