Oracle Linux: CVE-2023-5388: ELSA-2024-1494: thunderbird security update (MODERATE) (Multiple Advisories)
Description
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a Bleichenbacher or Manger like attack against all RSA decryption operations. As the leak happens before any padding operations, it affects all padding modes: PKCS#1 v1.5, OAEP, and RSASVP. Both API level calls and TLS server operation are affected.
Solution(s)
- oracle-linux-upgrade-firefox
- oracle-linux-upgrade-firefox-x11
- oracle-linux-upgrade-nspr
- oracle-linux-upgrade-nspr-devel
- oracle-linux-upgrade-nss
- oracle-linux-upgrade-nss-devel
- oracle-linux-upgrade-nss-softokn
- oracle-linux-upgrade-nss-softokn-devel
- oracle-linux-upgrade-nss-softokn-freebl
- oracle-linux-upgrade-nss-softokn-freebl-devel
- oracle-linux-upgrade-nss-sysinit
- oracle-linux-upgrade-nss-tools
- oracle-linux-upgrade-nss-util
- oracle-linux-upgrade-nss-util-devel
- oracle-linux-upgrade-thunderbird
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center