[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20150126050059.GA5693@openwall.com>
Date: Mon, 26 Jan 2015 08:00:59 +0300
From: "(GalaxyMaster)" <galaxy@...nwall.com>
To: owl-dev@...ts.openwall.com
Subject: Re: risk assessment for libnss
On Mon, Jan 26, 2015 at 06:07:00AM +0300, Owl CVS (galaxy) wrote:
> +2015/01/26 Package: libnss
> +SECURITY FIX Severity: none to low, local, passive
> +Updated to 3.17.3. which includes a fix for "RSA PKCS#1 signature
> +verification forgery is possible due to too-permissive SignatureAlgorithm
> +parameter parsing" (CVE-2014-1568) since version 3.17.1. The only part
> +affected by this in Owl is RPM since it is the only package using NSS
> +currently.
> +References:
> +https://bugzilla.mozilla.org/show_bug.cgi?id=1064636
> +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568
I'm not very good with risk assessments, feel free to update the above
as you want. The reason behind "none to low, local, passive" is that we
only have one package relying on Mozilla NSS - RPM. If it was not the
case and we had any services that would take input from the net, I'd
assign "none to medium, remote, active" since it would then possible to
forge CA certs and alike.
--
(GM)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
