USN-1106-1: NSS vulnerabilities
Description
It was discovered that several invalid HTTPS certificates were issued andrevoked. An attacker could exploit these to perform a man in the middleattack to view sensitive information or alter encrypted communications.These certificates were marked as explicitly not trusted to prevent theirmisuse. The problem can be corrected by updating your system to the following package version: To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to restart any applications thatuse NSS, such as Thunderbird or Evolution, to make all the necessarychanges. LP: 741729
Solution(s)
- ubuntu-upgrade-libnss3-1d
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center