Bug 1657913 (CVE-2018-12404)

Summary: CVE-2018-12404 nss: Cache side-channel variant of the Bleichenbacher attack
Product: [Other] Security Response Reporter: Laura Pardo <lpardo>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bmcclain, dblechte, dfediuck, dueno, eedri, elio.maldonado.batiz, kdudka, kengert, mgoldboi, michal.skrivanek, nss-nspr-maint, pvrabec, rh-spice-bugs, sbonazzo, sherold, slawomir, yturgema
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: nss 3.36.6, nss 3.40.1 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-08-06 13:20:55 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1658020, 1658019, 1658021, 1664539    
Bug Blocks: 1657914    

Description Laura Pardo 2018-12-10 17:33:20 UTC
An issue was found in nss before version 3.36.6. The TLS implementation exposes padding oracle in each of the three stages of handling PKCS #1 v1.5 padding


References:
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.6_release_notes
http://cat.eyalro.net/

Comment 2 Huzaifa S. Sidhpurwala 2018-12-11 03:42:17 UTC
This issue was also resolved via nss-3.40 as per:
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.40.1_release_notes

Comment 3 Doran Moppert 2019-01-09 05:28:30 UTC
Created nss tracking bugs for this issue:

Affects: fedora-all [bug 1664539]

Comment 4 errata-xmlrpc 2019-08-06 12:31:19 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2237 https://access.redhat.com/errata/RHSA-2019:2237

Comment 5 Product Security DevOps Team 2019-08-06 13:20:55 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-12404