In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to the versions of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a     crash due to a null dereference, resulting in a Denial of Service. (CVE-2018-18508)

  - In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to     crash, resulting in a denial of service. (CVE-2019-17007)

  - A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a     remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the     NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS     versions before 3.58. (CVE-2020-25648)

  - NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow     when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures     encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for     certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how     they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and     PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and     Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
    (CVE-2021-43527)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In Network Security Services (NSS) before 3.36.7 and     before 3.41.1, a malformed signature can cause a crash     due to a null dereference, resulting in a Denial of     Service.(CVE-2018-18508)

  - In Network Security Services before 3.44, a malformed     Netscape Certificate Sequence can cause NSS to crash,     resulting in a denial of service.(CVE-2019-17007)

  - A flaw was found in the way NSS handled CCS     (ChangeCipherSpec) messages in TLS 1.3. This flaw     allows a remote attacker to send multiple CCS messages,     causing a denial of service for servers compiled with     the NSS library. The highest threat from this     vulnerability is to system availability. This flaw     affects NSS versions before 3.58.(CVE-2020-25648)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0876 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    The nss-softokn package provides the Network Security Services Softoken Cryptographic Module.

    Security Fix(es):

    * nss: Use-after-free in sftk_FreeSession due to improper refcounting (CVE-2019-11756)

    * nss: Check length of inputs for cryptographic primitives (CVE-2019-17006)

    * nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref     leading to DoS (CVE-2019-17007)

    * nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read (CVE-2020-12403)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In Network Security Services (NSS) before 3.46, several     cryptographic primitives had missing length checks. In     cases where the application calling the library did not     perform a sanity check on the inputs it could result in     a crash due to a buffer overflow.(CVE-2019-17006)

  - NSS has shown timing differences when performing DSA     signatures, which was exploitable and could eventually     leak private keys. This vulnerability affects     Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR <     68.9.(CVE-2020-12399)

  - When converting coordinates from projective to affine,     the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel     attack. This vulnerability affects Firefox < 80 and     Firefox for Android < 80.(CVE-2020-12400)

  - A flaw was found in the way CHACHA20-POLY1305 was     implemented in NSS. When using multi-part Chacha20, it     could cause out-of-bounds reads. This issue was fixed     by explicitly disabling multi-part ChaCha20 (which was     not functioning correctly) and strictly enforcing tag     length. The highest threat from(CVE-2020-12403)

  - A flaw was found in the way NSS handled CCS     (ChangeCipherSpec) messages in TLS 1.3. This flaw     allows a remote attacker to send multiple CCS messages,     causing a denial of service for servers compiled with     the NSS library. The highest threat from this     vulnerability is to system availability. This flaw     affects NSS versions before 3.58.(CVE-2020-25648)

  - In Network Security Services before 3.44, a malformed     Netscape Certificate Sequence can cause NSS to crash,     resulting in a denial of service.(CVE-2019-17007)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way NSS handled CCS     (ChangeCipherSpec) messages in TLS 1.3. This flaw     allows a remote attacker to send multiple CCS messages,     causing a denial of service for servers compiled with     the NSS library. The highest threat from this     vulnerability is to system availability. This flaw     affects NSS versions before 3.58.(CVE-2020-25648)

  - In Network Security Services before 3.44, a malformed     Netscape Certificate Sequence can cause NSS to crash,     resulting in a denial of service.(CVE-2019-17007)

  - In Network Security Services (NSS) before 3.36.7 and     before 3.41.1, a malformed signature can cause a crash     due to a null dereference, resulting in a Denial of     Service.(CVE-2018-18508)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the nss packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In Network Security Services before 3.44, a malformed     Netscape Certificate Sequence can cause NSS to crash,     resulting in a denial of service.(CVE-2019-17007)

  - A flaw was found in the way NSS handled CCS     (ChangeCipherSpec) messages in TLS 1.3. This flaw     allows a remote attacker to send multiple CCS messages,     causing a denial of service for servers compiled with     the NSS library. The highest threat from this     vulnerability is to system availability. This flaw     affects NSS versions before 3.58.(CVE-2020-25648)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Network Security Services before 3.44, a malformed     Netscape Certificate Sequence can cause NSS to crash,     resulting in a denial of service.(CVE-2019-17007)

  - A flaw was found in the way NSS handled CCS     (ChangeCipherSpec) messages in TLS 1.3. This flaw     allows a remote attacker to send multiple CCS messages,     causing a denial of service for servers compiled with     the NSS library. The highest threat from this     vulnerability is to system availability. This flaw     affects NSS versions before 3.58.(CVE-2020-25648)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1951 advisory.

  - nss: NULL pointer dereference in several CMS functions resulting in a denial of service (CVE-2018-18508)

  - nss: Out-of-bounds read when importing curve25519 private key (CVE-2019-11719)

  - nss: PKCS#1 v1.5 signatures can be used for TLS 1.3 (CVE-2019-11727)

  - nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (CVE-2019-11729)

  - nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref     leading to DoS (CVE-2019-17007)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Network Security Services (NSS) before 3.36.7 and     before 3.41.1, a malformed signature can cause a crash     due to a null dereference, resulting in a Denial of     Service.(CVE-2018-18508)

  - In Network Security Services before 3.44, a malformed     Netscape Certificate Sequence can cause NSS to crash,     resulting in a denial of service.(CVE-2019-17007)

  - A flaw was found in the way NSS handled CCS     (ChangeCipherSpec) messages in TLS 1.3. This flaw     allows a remote attacker to send multiple CCS messages,     causing a denial of service for servers compiled with     the NSS library. The highest threat from this     vulnerability is to system availability. This flaw     affects NSS versions before 3.58.(CVE-2020-25648)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way NSS handled CCS     (ChangeCipherSpec) messages in TLS 1.3. This flaw     allows a remote attacker to send multiple CCS messages,     causing a denial of service for servers compiled with     the NSS library. The highest threat from this     vulnerability is to system availability. This flaw     affects NSS versions before 3.58.(CVE-2020-25648)

  - In Network Security Services before 3.44, a malformed     Netscape Certificate Sequence can cause NSS to crash,     resulting in a denial of service.(CVE-2019-17007)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - NSS has shown timing differences when performing DSA     signatures, which was exploitable and could eventually     leak private keys. This vulnerability affects     Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR <     68.9.(CVE-2020-12399)

  - When converting coordinates from projective to affine,     the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel     attack. This vulnerability affects Firefox < 80 and     Firefox for Android < 80.(CVE-2020-12400)

  - A flaw was found in the way CHACHA20-POLY1305 was     implemented in NSS. When using multi-part Chacha20, it     could cause out-of-bounds reads. This issue was fixed     by explicitly disabling multi-part ChaCha20 (which was     not functioning correctly) and strictly enforcing tag     length. The highest threat from(CVE-2020-12403)

  - A flaw was found in the way NSS handled CCS     (ChangeCipherSpec) messages in TLS 1.3. This flaw     allows a remote attacker to send multiple CCS messages,     causing a denial of service for servers compiled with     the NSS library. The highest threat from this     vulnerability is to system availability. This flaw     affects NSS versions before 3.58.(CVE-2020-25648)

  - In Network Security Services before 3.44, a malformed     Netscape Certificate Sequence can cause NSS to crash,     resulting in a denial of service.(CVE-2019-17007)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Various vulnerabilities were fixed in nss, the Network Security Service libraries.

CVE-2018-12404

Cache side-channel variant of the Bleichenbacher attack.

CVE-2018-18508

NULL pointer dereference in several CMS functions resulting in a denial of service.

CVE-2019-11719

Out-of-bounds read when importing curve25519 private key.

CVE-2019-11729

Empty or malformed p256-ECDH public keys may trigger a segmentation fault.

CVE-2019-11745

Out-of-bounds write when encrypting with a block cipher.

CVE-2019-17006

Some cryptographic primitives did not check the length of the input text, potentially resulting in overflows.

CVE-2019-17007

Handling of Netscape Certificate Sequences may crash with a NULL dereference leading to a denial of service.

CVE-2020-12399

Force a fixed length for DSA exponentiation.

CVE-2020-6829 CVE-2020-12400

Side channel attack on ECDSA signature generation.

CVE-2020-12401

ECDSA timing attack mitigation bypass.

CVE-2020-12402

Side channel vulnerabilities during RSA key generation.

CVE-2020-12403

CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read.

For Debian 9 stretch, these problems have been fixed in version 2:3.26.2-1.1+deb9u2.

We recommend that you upgrade your nss packages.

For the detailed security status of nss please refer to its security tracker page at: https://security-tracker.debian.org/tracker/nss

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4215-1 advisory.

    It was discovered that NSS incorrectly handled certain certificates. An attacker could possibly use this     issue to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Two vulnerabilities were discovered in NSS, a set of cryptographic libraries, which may result in denial of service and potentially the execution of arbitrary code.

Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may haved crash with a NULL deref leading to a denial of service.

For Debian 8 'Jessie', this problem has been fixed in version 2:3.26-1+debu8u8.

We recommend that you upgrade your nss packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2237 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

    The following packages have been upgraded to a later upstream version: nss (3.44.0), nss-softokn (3.44.0),     nss-util (3.44.0), nspr (4.21.0). (BZ#1645231, BZ#1692269, BZ#1692271, BZ#1692274)

    Security Fix(es):

    * ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)

    * nss: Cache side-channel variant of the Bleichenbacher attack (CVE-2018-12404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1951 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

    The following packages have been upgraded to a later upstream version: nss (3.44.0), nspr (4.21.0).
    (BZ#1713187, BZ#1713188)

    Security Fix(es):

    * nss: NULL pointer dereference in several CMS functions resulting in a denial of service (CVE-2018-18508)

    * nss: Out-of-bounds read when importing curve25519 private key (CVE-2019-11719)

    * nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (CVE-2019-11729)

    * nss: PKCS#1 v1.5 signatures can be used for TLS 1.3 (CVE-2019-11727)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * PQG verify fails when create DSA PQG parameters because the counts aren't returned correctly.
    (BZ#1685325)

    * zeroization of AES context missing (BZ#1719629)

    * RSA Pairwise consistency test (BZ#1719630)

    * FIPS updated for nss-softoken POST (BZ#1722373)

    * DH/ECDH key tests missing for the PG parameters (BZ#1722374)

    * NSS should implement continuous random test on it's seed data or use the kernel AF_ALG interface for     random (BZ#1725059)

    * support setting supported signature algorithms in strsclnt utility (BZ#1725110)

    * certutil -F with no parameters is killed with segmentation fault message (BZ#1725115)

    * NSS: Support for IKE/IPsec typical PKIX usage so libreswan can use nss without rejecting certs based on     EKU (BZ#1725116)

    * NSS should use getentropy() for seeding its RNG, not /dev/urandom. Needs update to NSS 3.37 (BZ#1725117)

    * Disable TLS 1.3 in FIPS mode (BZ#1725773)

    * Wrong alert sent when client uses PKCS#1 signatures in TLS 1.3 (BZ#1728259)

    * x25519 allowed in FIPS mode (BZ#1728260)

    * post handshake authentication with selfserv does not work if SSL_ENABLE_SESSION_TICKETS is set     (BZ#1728261)

    Enhancement(s):

    * Move IKEv1 and IKEv2 KDF's from libreswan to nss-softkn (BZ#1719628)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
501634	Siemens RUGGEDCOM ROX II Improper Certificate Validation (CVE-2019-17007)	Tenable OT Security	Tenable.ot	high
175212	EulerOS Virtualization 3.0.2.0 : nss (EulerOS-SA-2023-1713)	Nessus	Huawei Local Security Checks	critical
151417	EulerOS Virtualization 3.0.2.2 : nss (EulerOS-SA-2021-2150)	Nessus	Huawei Local Security Checks	high
147829	RHEL 7 : nss and nss-softokn (RHSA-2021:0876)	Nessus	Red Hat Local Security Checks	critical
147683	EulerOS Virtualization 2.9.0 : nss (EulerOS-SA-2021-1640)	Nessus	Huawei Local Security Checks	critical
147550	EulerOS Virtualization 2.9.1 : nss (EulerOS-SA-2021-1615)	Nessus	Huawei Local Security Checks	critical
147074	EulerOS Virtualization 3.0.6.6 : nss (EulerOS-SA-2021-1502)	Nessus	Huawei Local Security Checks	high
147039	EulerOS Virtualization for ARM 64 3.0.6.0 : nss (EulerOS-SA-2021-1562)	Nessus	Huawei Local Security Checks	high
146747	EulerOS 2.0 SP2 : nss (EulerOS-SA-2021-1333)	Nessus	Huawei Local Security Checks	high
145690	CentOS 8 : nss and nspr (CESA-2019:1951)	Nessus	CentOS Local Security Checks	high
145155	EulerOS 2.0 SP3 : nss (EulerOS-SA-2021-1102)	Nessus	Huawei Local Security Checks	high
144265	EulerOS 2.0 SP5 : nss (EulerOS-SA-2020-2572)	Nessus	Huawei Local Security Checks	high
143400	EulerOS 2.0 SP9 : nss (EulerOS-SA-2020-2487)	Nessus	Huawei Local Security Checks	critical
143390	EulerOS 2.0 SP9 : nss (EulerOS-SA-2020-2500)	Nessus	Huawei Local Security Checks	critical
143254	EulerOS 2.0 SP8 : nss (EulerOS-SA-2020-2478)	Nessus	Huawei Local Security Checks	high
141062	Debian DLA-2388-1 : nss security update	Nessus	Debian Local Security Checks	critical
131923	Ubuntu 16.04 LTS / 18.04 LTS : NSS vulnerability (USN-4215-1)	Nessus	Ubuntu Local Security Checks	high
131784	Debian DSA-4579-1 : nss - security update	Nessus	Debian Local Security Checks	high
131433	Debian DLA-2015-1 : nss security update	Nessus	Debian Local Security Checks	high
127699	RHEL 7 : nss, nss-softokn, nss-util, and nspr (RHSA-2019:2237)	Nessus	Red Hat Local Security Checks	medium
127636	RHEL 8 : nss and nspr (RHSA-2019:1951)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2019-17007

high

Tenable Plugins

high

critical

high

critical

critical

critical

high

high

high

high

high

high

critical

critical

high

critical

high

high

high

medium

high