Linux · Security advisory · August 3, 2020

RHSA-2020:3280: Security update for 12 packages

RHSA-2020:3280, released August 3, 2020, fixes 5 CVEs across 12 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0356
89th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 2 Routine 3

Fixed package versions

ProductReleaseFixed in
nsprRHEL 80:4.25.0-2.el8_2
nspr-develRHEL 80:4.25.0-2.el8_2
nssRHEL 80:3.53.1-11.el8_2
nss-develRHEL 80:3.53.1-11.el8_2
nss-softoknRHEL 80:3.53.1-11.el8_2
nss-softokn-develRHEL 80:3.53.1-11.el8_2
nss-softokn-freeblRHEL 80:3.53.1-11.el8_2
nss-softokn-freebl-develRHEL 80:3.53.1-11.el8_2
nss-sysinitRHEL 80:3.53.1-11.el8_2
nss-toolsRHEL 80:3.53.1-11.el8_2
nss-utilRHEL 80:3.53.1-11.el8_2
nss-util-develRHEL 80:3.53.1-11.el8_2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2019-17006 nss-softokn: Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-... 9.8 0.0356 None reported
High CVE-2019-11756 Firefox ESR: Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited… 8.8 0.0149 None reported
Routine CVE-2019-17023 Firefox ESR: After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting… 6.5 0.0134 None reported
Routine CVE-2020-12399 Firefox ESR: NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually… 4.4 0.0065 None reported
Routine CVE-2020-12402 Firefox ESR: During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm… 4.4 0.0034 None reported
Showing 1 to 5 of 5 1