Bug 2024370 (CVE-2021-43527)

Summary:	CVE-2021-43527 nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	aaiken, aarif, acrosby, bdettelb, caswilli, cperry, crypto-team, dmoppert, dueno, elio.maldonado.batiz, erack, fcanogab, fjansen, hasuzuki, hkario, huzaifas, jburrell, jhorak, jtanner, jwong, kai-engert-fedora, kaycoth, kdudka, kholdawa, michal.skrivanek, mperina, nobody, nss-nspr-maint, rh-spice-bugs, rrelyea, sbarcomb, sbonazzo, security-response-team, snikolov, ssorce, stransky, tmihinto, tpelka, tpopela, vkumar, wrussell
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nss 3.73.0, nss 3.68.1	Doc Type:	If docs needed, set a value
Doc Text:	A remote code execution flaw was found in the way NSS verifies certificates. This flaw allows an attacker posing as an SSL/TLS server to trigger this issue in a client application compiled with NSS when it tries to initiate an SSL/TLS connection. Similarly, a server application compiled with NSS, which processes client certificates, can receive a malicious certificate via a client, triggering the flaw. The highest threat to this vulnerability is confidentiality, integrity, as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-12-08 19:34:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2025361, 2025362, 2025363, 2025364, 2025365, 2025366, 2027160, 2027161, 2027162, 2027163, 2027164, 2027165, 2027166, 2027167, 2027248, 2027409, 2027573, 2027574, 2027934, 2027935, 2027936, 2028186
Bug Blocks:	2024113

Description msiddiqu 2021-11-17 23:31:04 UTC

A flaw was found in the way NSS verifies certificates. That will happen both when client reads the Certificate message from the server or when server is configured to ask for client certificates and then receives one.

Firefox is not vulnerable as it uses the mozilla::pkix for certificate verification. Crucially, NSS fully parses the certificate before any other checks, so disabled signature methods or certificate types don't impact exploitability.

Any TLS and DTLS client that does use NSS built in certificate verification routines is vulnerable as well as any server that has certificate based client authentication enabled.

But the issue is not limited to TLS, any applications that use certificate verification are vulnerable, S/MIME is impacted too.

Comment 18 Huzaifa S. Sidhpurwala 2021-12-01 16:20:10 UTC

Upstream patch: https://hg.mozilla.org/projects/nss/rev/6b3dc97a8767d9dc5c4c181597d1341d0899aa58

Comment 19 Huzaifa S. Sidhpurwala 2021-12-01 16:51:26 UTC

Created nss tracking bugs for this issue:

Affects: fedora-all [bug 2028186]

Comment 20 errata-xmlrpc 2021-12-01 18:12:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4903 https://access.redhat.com/errata/RHSA-2021:4903

Comment 21 errata-xmlrpc 2021-12-01 18:37:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:4904 https://access.redhat.com/errata/RHSA-2021:4904

Comment 23 errata-xmlrpc 2021-12-01 22:23:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Extended Lifecycle Support

Via RHSA-2021:4907 https://access.redhat.com/errata/RHSA-2021:4907

Comment 25 errata-xmlrpc 2021-12-02 09:04:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2021:4909 https://access.redhat.com/errata/RHSA-2021:4909

Comment 26 errata-xmlrpc 2021-12-02 18:25:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:4919 https://access.redhat.com/errata/RHSA-2021:4919

Comment 31 errata-xmlrpc 2021-12-06 08:51:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support

Via RHSA-2021:4932 https://access.redhat.com/errata/RHSA-2021:4932

Comment 32 errata-xmlrpc 2021-12-06 09:00:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Advanced Update Support
  Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.6 Telco Extended Update Support

Via RHSA-2021:4933 https://access.redhat.com/errata/RHSA-2021:4933

Comment 33 errata-xmlrpc 2021-12-06 12:47:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support
  Red Hat Enterprise Linux 7.7 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.7 Telco Extended Update Support

Via RHSA-2021:4946 https://access.redhat.com/errata/RHSA-2021:4946

Comment 34 errata-xmlrpc 2021-12-06 19:05:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:4953 https://access.redhat.com/errata/RHSA-2021:4953

Comment 35 errata-xmlrpc 2021-12-06 19:28:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:4954 https://access.redhat.com/errata/RHSA-2021:4954

Comment 36 errata-xmlrpc 2021-12-06 22:38:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2021:4969 https://access.redhat.com/errata/RHSA-2021:4969

Comment 37 errata-xmlrpc 2021-12-07 15:43:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support

Via RHSA-2021:4994 https://access.redhat.com/errata/RHSA-2021:4994

Comment 40 errata-xmlrpc 2021-12-08 07:40:04 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2021:5006 https://access.redhat.com/errata/RHSA-2021:5006

Comment 42 errata-xmlrpc 2021-12-08 18:28:54 UTC

This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2021:5035 https://access.redhat.com/errata/RHSA-2021:5035

Comment 44 Product Security DevOps Team 2021-12-08 19:34:15 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-43527