# CVE-2019-17006: nss-softokn: Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-... CVE-2019-17006 is fixed in 14 products on 1 platform, first by libnss3 2:3.35-2ubuntu2.7, released December 30, 2019. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2019-17006 - Priority: High - CVSS: 9.8 (Moderate) - EPSS: 0.0356 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Dec 30, 2019 ## Description Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. The following packages have been upgraded to a later upstream version: nss (3.53.1), nspr (4.25.0). (BZ#1809549, BZ#1809550) Security Fix(es): * nss: UAF in sftk_FreeSession due to improper refcounting (CVE-2019-11756) * nss: Check length of inputs for cryptographic primitives (CVE-2019-17006) * nss: Side channel vulnerabilities during RSA key generation (CVE-2020-12402) * nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state (CVE-2019-17023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Install of update of nss.x86_64 adds i686 into transaction (BZ#1663187) * NSS does not set downgrade sentinel in ServerHello.random for TLS 1.0 and TLS 1.1 (BZ#1691409) * TLS Keying Material Exporter is unsupported by command line tools (BZ#1691454) * TLS_AES_256_GCM_SHA384 is not marked as FIPS compatible (BZ#1711375) * Make TLS 1.3 work in FIPS mode (BZ#1724250) * NSS rejects records with large padding with SHA384 HMAC (BZ#1750921) * NSS missing IKEv1 Quick Mode KDF (BZ#1809637) * Name Constraints validation: CN treated as DNS name even when syntactically invalid as DNS name (BZ#1825270) * FIPS needs nss to restrict valid dh primes to those primes that are approved. (BZ#1854564) * nss needs to comply to the new SP800-56A rev 3 requirements (BZ#1855825) Enhancement(s): * [RFE] nss should use AES for storage of keys (BZ#1723819) ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libnss3 Ubuntu 18.04.6 LTS (bionic) | 2:3.35-2ubuntu2.7 | [libnss3 2:3.35-2ubuntu2.7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libnss3-2-3.35-2ubuntu2.7.md) | Dec 30, 2019 | | Linux | libnss3-tools Ubuntu 18.04.6 LTS (bionic) | 2:3.35-2ubuntu2.7 | [libnss3-tools 2:3.35-2ubuntu2.7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libnss3-tools-2-3.35-2ubuntu2.7.md) | Dec 30, 2019 | | Linux | nspr RHEL 8 | 0:4.25.0-2.el8_2 | [RHSA-2020:3280](https://patchblox.com/security/data/fix/linux/rhsa-2020-3280.md) | Aug 3, 2020 | | Linux | nspr ol 8 | 0:4.25.0-2.el8_2 | [ELSA-2020-3280](https://patchblox.com/security/data/fix/linux/elsa-2020-3280.md) | Aug 4, 2020 | | Linux | nspr-devel RHEL 8 | 0:4.25.0-2.el8_2 | [RHSA-2020:3280](https://patchblox.com/security/data/fix/linux/rhsa-2020-3280.md) | Aug 3, 2020 | | Linux | nspr-devel ol 8 | 0:4.25.0-2.el8_2 | [ELSA-2020-3280](https://patchblox.com/security/data/fix/linux/elsa-2020-3280.md) | Aug 4, 2020 | | Linux | nss RHEL 8 | 0:3.53.1-11.el8_2 | [RHSA-2020:3280](https://patchblox.com/security/data/fix/linux/rhsa-2020-3280.md) | Aug 3, 2020 | | Linux | nss ol 8 | 0:3.53.1-11.el8_2 | [ELSA-2020-3280](https://patchblox.com/security/data/fix/linux/elsa-2020-3280.md) | Aug 4, 2020 | | Linux | nss-devel RHEL 8 | 0:3.53.1-11.el8_2 | [RHSA-2020:3280](https://patchblox.com/security/data/fix/linux/rhsa-2020-3280.md) | Aug 3, 2020 | | Linux | nss-devel ol 8 | 0:3.53.1-11.el8_2 | [ELSA-2020-3280](https://patchblox.com/security/data/fix/linux/elsa-2020-3280.md) | Aug 4, 2020 | | Linux | nss-softokn RHEL 8 | 0:3.53.1-11.el8_2 | [RHSA-2020:3280](https://patchblox.com/security/data/fix/linux/rhsa-2020-3280.md) | Aug 3, 2020 | | Linux | nss-softokn ol 8 | 0:3.53.1-11.el8_2 | [ELSA-2020-3280](https://patchblox.com/security/data/fix/linux/elsa-2020-3280.md) | Aug 4, 2020 | | Linux | nss-softokn-devel RHEL 8 | 0:3.53.1-11.el8_2 | [RHSA-2020:3280](https://patchblox.com/security/data/fix/linux/rhsa-2020-3280.md) | Aug 3, 2020 | | Linux | nss-softokn-devel ol 8 | 0:3.53.1-11.el8_2 | [ELSA-2020-3280](https://patchblox.com/security/data/fix/linux/elsa-2020-3280.md) | Aug 4, 2020 | | Linux | nss-softokn-freebl RHEL 8 | 0:3.53.1-11.el8_2 | [RHSA-2020:3280](https://patchblox.com/security/data/fix/linux/rhsa-2020-3280.md) | Aug 3, 2020 | | Linux | nss-softokn-freebl ol 8 | 0:3.53.1-11.el8_2 | [ELSA-2020-3280](https://patchblox.com/security/data/fix/linux/elsa-2020-3280.md) | Aug 4, 2020 | | Linux | nss-softokn-freebl-devel RHEL 8 | 0:3.53.1-11.el8_2 | [RHSA-2020:3280](https://patchblox.com/security/data/fix/linux/rhsa-2020-3280.md) | Aug 3, 2020 | | Linux | nss-softokn-freebl-devel ol 8 | 0:3.53.1-11.el8_2 | [ELSA-2020-3280](https://patchblox.com/security/data/fix/linux/elsa-2020-3280.md) | Aug 4, 2020 | | Linux | nss-sysinit RHEL 8 | 0:3.53.1-11.el8_2 | [RHSA-2020:3280](https://patchblox.com/security/data/fix/linux/rhsa-2020-3280.md) | Aug 3, 2020 | | Linux | nss-sysinit ol 8 | 0:3.53.1-11.el8_2 | [ELSA-2020-3280](https://patchblox.com/security/data/fix/linux/elsa-2020-3280.md) | Aug 4, 2020 | | Linux | nss-tools RHEL 8 | 0:3.53.1-11.el8_2 | [RHSA-2020:3280](https://patchblox.com/security/data/fix/linux/rhsa-2020-3280.md) | Aug 3, 2020 | | Linux | nss-tools ol 8 | 0:3.53.1-11.el8_2 | [ELSA-2020-3280](https://patchblox.com/security/data/fix/linux/elsa-2020-3280.md) | Aug 4, 2020 | | Linux | nss-util RHEL 8 | 0:3.53.1-11.el8_2 | [RHSA-2020:3280](https://patchblox.com/security/data/fix/linux/rhsa-2020-3280.md) | Aug 3, 2020 | | Linux | nss-util ol 8 | 0:3.53.1-11.el8_2 | [ELSA-2020-3280](https://patchblox.com/security/data/fix/linux/elsa-2020-3280.md) | Aug 4, 2020 | | Linux | nss-util-devel RHEL 8 | 0:3.53.1-11.el8_2 | [RHSA-2020:3280](https://patchblox.com/security/data/fix/linux/rhsa-2020-3280.md) | Aug 3, 2020 | | Linux | nss-util-devel ol 8 | 0:3.53.1-11.el8_2 | [ELSA-2020-3280](https://patchblox.com/security/data/fix/linux/elsa-2020-3280.md) | Aug 4, 2020 | --- Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.