Date: Mon, 26 Jan 2015 08:00:59 +0300 From: "(GalaxyMaster)" <galaxy@...nwall.com> To: owl-dev@...ts.openwall.com Subject: Re: risk assessment for libnss On Mon, Jan 26, 2015 at 06:07:00AM +0300, Owl CVS (galaxy) wrote: > +2015/01/26 Package: libnss > +SECURITY FIX Severity: none to low, local, passive > +Updated to 3.17.3. which includes a fix for "RSA PKCS#1 signature > +verification forgery is possible due to too-permissive SignatureAlgorithm > +parameter parsing" (CVE-2014-1568) since version 3.17.1. The only part > +affected by this in Owl is RPM since it is the only package using NSS > +currently. > +References: > +https://bugzilla.mozilla.org/show_bug.cgi?id=1064636 > +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568 I'm not very good with risk assessments, feel free to update the above as you want. The reason behind "none to low, local, passive" is that we only have one package relying on Mozilla NSS - RPM. If it was not the case and we had any services that would take input from the net, I'd assign "none to medium, remote, active" since it would then possible to forge CA certs and alike. -- (GM)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.