# RHSA-2020:3280: Security update for 12 packages

RHSA-2020:3280, released August 3, 2020, fixes 5 CVEs across 12 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/rhsa-2020-3280
- Platform: Linux
- Released: Aug 3, 2020
- Priority: High (Closes CVE-2019-17006, high severity)
- CVEs: 5, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://access.redhat.com/errata/RHSA-2020:3280

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [nspr](https://patchblox.com/security/data/product/linux/nspr.md) | RHEL 8 | 0:4.25.0-2.el8_2 |
| [nspr-devel](https://patchblox.com/security/data/product/linux/nspr-devel.md) | RHEL 8 | 0:4.25.0-2.el8_2 |
| [nss](https://patchblox.com/security/data/product/linux/nss.md) | RHEL 8 | 0:3.53.1-11.el8_2 |
| [nss-devel](https://patchblox.com/security/data/product/linux/nss-devel.md) | RHEL 8 | 0:3.53.1-11.el8_2 |
| [nss-softokn](https://patchblox.com/security/data/product/linux/nss-softokn.md) | RHEL 8 | 0:3.53.1-11.el8_2 |
| [nss-softokn-devel](https://patchblox.com/security/data/product/linux/nss-softokn-devel.md) | RHEL 8 | 0:3.53.1-11.el8_2 |
| [nss-softokn-freebl](https://patchblox.com/security/data/product/linux/nss-softokn-freebl.md) | RHEL 8 | 0:3.53.1-11.el8_2 |
| [nss-softokn-freebl-devel](https://patchblox.com/security/data/product/linux/nss-softokn-freebl-devel.md) | RHEL 8 | 0:3.53.1-11.el8_2 |
| [nss-sysinit](https://patchblox.com/security/data/product/linux/nss-sysinit.md) | RHEL 8 | 0:3.53.1-11.el8_2 |
| [nss-tools](https://patchblox.com/security/data/product/linux/nss-tools.md) | RHEL 8 | 0:3.53.1-11.el8_2 |
| [nss-util](https://patchblox.com/security/data/product/linux/nss-util.md) | RHEL 8 | 0:3.53.1-11.el8_2 |
| [nss-util-devel](https://patchblox.com/security/data/product/linux/nss-util-devel.md) | RHEL 8 | 0:3.53.1-11.el8_2 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2019-17006](https://patchblox.com/security/data/cve/CVE-2019-17006.md) | High | nss-softokn: Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-... | 9.8 | 0.0356 |  |
| [CVE-2019-11756](https://patchblox.com/security/data/cve/CVE-2019-11756.md) | High | Firefox ESR: Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited… | 8.8 | 0.0149 |  |
| [CVE-2019-17023](https://patchblox.com/security/data/cve/CVE-2019-17023.md) | Routine | Firefox ESR: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting… | 6.5 | 0.0134 |  |
| [CVE-2020-12399](https://patchblox.com/security/data/cve/CVE-2020-12399.md) | Routine | Firefox ESR: NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually… | 4.4 | 0.0065 |  |
| [CVE-2020-12402](https://patchblox.com/security/data/cve/CVE-2020-12402.md) | Routine | Firefox ESR: During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm… | 4.4 | 0.0034 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo