Synopsis

Important: nss security update

Type/Severity

Security Advisory: Important

Topic

Updated nss packages that fix one security issue are now available for
Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having
important security impact.

Description

Network Security Services (NSS) is a set of libraries designed to support
the development of security-enabled client and server applications.

It was found that the Malaysia-based Digicert Sdn. Bhd. subordinate
Certificate Authority (CA) issued HTTPS certificates with weak keys. This
update renders any HTTPS certificates signed by that CA as untrusted. This
covers all uses of the certificates, including SSL, S/MIME, and code
signing. Note: Digicert Sdn. Bhd. is not the same company as found at
digicert.com. (BZ#751366)

Note: This fix only applies to applications using the NSS Builtin Object
Token. It does not render the certificates untrusted for applications that
use the NSS library, but do not use the NSS Builtin Object Token.

This update also fixes the following bug on Red Hat Enterprise Linux 5:

• When using mod_nss with the Apache HTTP Server, a bug in NSS on Red Hat
  Enterprise Linux 5 resulted in file descriptors leaking each time the
  Apache HTTP Server was restarted with the "service httpd reload" command.
  This could have prevented the Apache HTTP Server from functioning properly
  if all available file descriptors were consumed. (BZ#743508)
  

For Red Hat Enterprise Linux 6, these updated packages upgrade NSS to
version 3.12.10. As well, they upgrade NSPR (Netscape Portable Runtime) to
version 4.8.8 and nss-util to version 3.12.10 on Red Hat
Enterprise Linux 6, as required by the NSS update. (BZ#735972, BZ#736272,
BZ#735973)

All NSS users should upgrade to these updated packages, which correct this
issue. After installing the update, applications using NSS must be
restarted for the changes to take effect. In addition, on Red Hat
Enterprise Linux 6, applications using NSPR and nss-util must also be
restarted.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server - Extended Update Support 6.1 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 6.1 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.1 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.1 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.1 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.1 i386
• Red Hat Virtual Storage Appliance (from RHUI) 6.1 x86_64

Fixes

• BZ - 735972 - Update nss to 3.12.10
• BZ - 735973 - Update nss-util to 3.12.10
• BZ - 736272 - Update nspr to 4.8.8
• BZ - 743508 - File descriptor leak after "service httpd reload"
• BZ - 751366 - Revoking Trust in DigiCert Sdn. Bhd Intermediate Certificate Authority from nss

CVEs

(none)

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 5

SRPM
x86_64
nss-devel-3.12.10-7.el5_7.i386.rpm	SHA-256: a8e5e8f2cad0c240ce772c661beb3ca20fda6df018d0f197f50ba5eedcac33df
nss-devel-3.12.10-7.el5_7.x86_64.rpm	SHA-256: f81377f5a9a606b0db6bf6d8316dea5e7bcfe9facb853946755cda20674fece6
nss-pkcs11-devel-3.12.10-7.el5_7.i386.rpm	SHA-256: a541e2a9dba4eaf67f5e13a352ecae0330c4abd024fb3604dada84c27fbff048
nss-pkcs11-devel-3.12.10-7.el5_7.x86_64.rpm	SHA-256: d883087fac1516160235a8ef98b8526bb79c4dfb042e652030817652ce6829bc
i386
nss-devel-3.12.10-7.el5_7.i386.rpm	SHA-256: a8e5e8f2cad0c240ce772c661beb3ca20fda6df018d0f197f50ba5eedcac33df
nss-pkcs11-devel-3.12.10-7.el5_7.i386.rpm	SHA-256: a541e2a9dba4eaf67f5e13a352ecae0330c4abd024fb3604dada84c27fbff048

Red Hat Enterprise Linux Workstation 5

SRPM
x86_64
nss-devel-3.12.10-7.el5_7.i386.rpm	SHA-256: a8e5e8f2cad0c240ce772c661beb3ca20fda6df018d0f197f50ba5eedcac33df
nss-devel-3.12.10-7.el5_7.x86_64.rpm	SHA-256: f81377f5a9a606b0db6bf6d8316dea5e7bcfe9facb853946755cda20674fece6
nss-pkcs11-devel-3.12.10-7.el5_7.i386.rpm	SHA-256: a541e2a9dba4eaf67f5e13a352ecae0330c4abd024fb3604dada84c27fbff048
nss-pkcs11-devel-3.12.10-7.el5_7.x86_64.rpm	SHA-256: d883087fac1516160235a8ef98b8526bb79c4dfb042e652030817652ce6829bc
i386
nss-devel-3.12.10-7.el5_7.i386.rpm	SHA-256: a8e5e8f2cad0c240ce772c661beb3ca20fda6df018d0f197f50ba5eedcac33df
nss-pkcs11-devel-3.12.10-7.el5_7.i386.rpm	SHA-256: a541e2a9dba4eaf67f5e13a352ecae0330c4abd024fb3604dada84c27fbff048

Red Hat Enterprise Linux Server from RHUI 5

SRPM
x86_64
nss-devel-3.12.10-7.el5_7.i386.rpm	SHA-256: a8e5e8f2cad0c240ce772c661beb3ca20fda6df018d0f197f50ba5eedcac33df
nss-devel-3.12.10-7.el5_7.x86_64.rpm	SHA-256: f81377f5a9a606b0db6bf6d8316dea5e7bcfe9facb853946755cda20674fece6
nss-pkcs11-devel-3.12.10-7.el5_7.i386.rpm	SHA-256: a541e2a9dba4eaf67f5e13a352ecae0330c4abd024fb3604dada84c27fbff048
nss-pkcs11-devel-3.12.10-7.el5_7.x86_64.rpm	SHA-256: d883087fac1516160235a8ef98b8526bb79c4dfb042e652030817652ce6829bc
i386
nss-devel-3.12.10-7.el5_7.i386.rpm	SHA-256: a8e5e8f2cad0c240ce772c661beb3ca20fda6df018d0f197f50ba5eedcac33df
nss-pkcs11-devel-3.12.10-7.el5_7.i386.rpm	SHA-256: a541e2a9dba4eaf67f5e13a352ecae0330c4abd024fb3604dada84c27fbff048