RHBA-2013:0445 - Bug Fix Advisory

Topic

Updated nss, nss-util, and nspr packages that fix multiple bugs and add various
enhancements are now available for Red Hat Enterprise Linux 6.

Description

Network Security Services (NSS) is a set of libraries designed to support the
cross-platform development of security-enabled client and server applications.
Netscape Portable Runtime (NSPR) provides platform independence for non-GUI
operating system facilities.

The nss and nss-util packages have been upgraded to upstream version 3.14 which
provides a number of bug fixes and enhancements over the previous version. In
particular, support for TLS version 1.1 in NSS (RFC 4346). In addition, the nspr
packages have been upgraded to upstream version 4.9.2. Note that support for
certificate signatures using the MD5 hash algorithm is now disabled by default.
For more information, refer to the Mozilla NSS 3.14 Release Notes. (BZ#837089,
BZ#863285, BZ#863286)

This update fixes the following bugs:

• The Privacy Enhanced Mail (PEM) module initialization function did not return

an error informing the caller that it is not thread-safe. Consequently, invalid
writes were made resulting in unexpected terminations in multi-threaded
libcurl-based applications. The PEM module initialization function now returns
the PKCS #11 prescribed KR_CANT_LOCK constant when the type of locking requested
by the caller for thread safety is not available. As a result, clients are
informed of the lack of thread safety and can provide their own locking to
prevent crashes. (BZ#555019)

• Due to a missing out-of-memory (OOM) check and improper freeing of allocated

memory, the Privacy Enhanced Mail (PEM) module did not fully validate the
encoding of certificates stored in a PEM-formatted file. As a consequence, error
handling tests failed. With this update, the PEM module correctly validates the
encoding, handles memory deallocation consistently, and error handling tests
pass as expected. (BZ#827351)

Users of nss, nspr, and nss-util are advised to upgrade to these updated
packages, which fix these bugs and add these enhancements. After installing this
update, applications using NSS, NSPR, or nss-util must be restarted for this
update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 811314 - remote-viewer does not utilize smart card reader plugged when the client is running
• BZ - 835970 - The patches in the spec file need an upstream bug link or comment
• BZ - 863285 - Rebase nss-util to 3.14
• BZ - 863286 - Rebase nspr to 4.9.2 or 4.9.3
• BZ - 872838 - nss 3.14 breaks fedpkg new-sources

CVEs

(none)

References

• https://developer.mozilla.org/en-US/docs/NSS/NSS_3.14_release_notes