Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 531628 (CVE-2014-1569)

Summary: <dev-libs/nss-3.17.3: QuickDER Decoder security bypass (CVE-2014-1569)
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: mozilla
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes
Whiteboard: A4 [noglsa]
Package list:
Runtime testing required: ---

Description Agostino Sarubbo gentoo-dev 2014-12-04 08:42:21 UTC
From ${URL} :

Notable Changes in NSS 3.17.3:
The QuickDER decoder now decodes lengths robustly (CVE-2014-1569).


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2014-12-04 09:01:58 UTC
Arches please test and mark stable =dev-libs/nss-3.17.3 with target KEYWORDS:

alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris
Comment 2 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2014-12-05 12:44:25 UTC
amd64 stable
Comment 3 Jeroen Roovers (RETIRED) gentoo-dev 2014-12-05 15:23:43 UTC
Stable for HPPA.
Comment 4 Agostino Sarubbo gentoo-dev 2014-12-06 17:02:51 UTC
x86 stable
Comment 5 Agostino Sarubbo gentoo-dev 2014-12-07 12:08:53 UTC
ppc stable
Comment 6 Agostino Sarubbo gentoo-dev 2014-12-10 09:48:07 UTC
ppc64 stable
Comment 7 Agostino Sarubbo gentoo-dev 2014-12-12 09:39:39 UTC
ia64 stable
Comment 8 Markus Meier gentoo-dev 2014-12-16 20:48:03 UTC
arm stable
Comment 9 Agostino Sarubbo gentoo-dev 2014-12-23 09:31:23 UTC
alpha stable
Comment 10 Agostino Sarubbo gentoo-dev 2014-12-26 09:19:50 UTC
sparc stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 11 Yury German Gentoo Infrastructure gentoo-dev 2014-12-28 14:59:18 UTC
Arches, Thank you for your work
Maintainer(s), please drop the vulnerable version(s).

GLSA Vote: No
Comment 12 GLSAMaker/CVETool Bot gentoo-dev 2014-12-28 18:51:35 UTC
CVE-2014-1569 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1569):
  The definite_length_decoder function in lib/util/quickder.c in Mozilla
  Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3
  does not ensure that the DER encoding of an ASN.1 length is properly formed,
  which allows remote attackers to conduct data-smuggling attacks by using a
  long byte sequence for an encoding, as demonstrated by the
  SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length
  encoding of 0x00.
Comment 13 Kristian Fiskerstrand (RETIRED) gentoo-dev 2014-12-28 18:52:23 UTC
GLSA Vote: No, marking noglsa
Comment 14 Yury German Gentoo Infrastructure gentoo-dev 2014-12-28 18:54:25 UTC
Maintainer(s), please drop the vulnerable version(s).

I am using all other open NSS bugs as depend for this bug for cleanup.
Comment 15 Yury German Gentoo Infrastructure gentoo-dev 2015-01-28 22:37:27 UTC
Maintainer(s), it has been 30 days since request for cleanup. 
Please drop the vulnerable versions.
Comment 16 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2015-01-31 17:54:20 UTC
+*nss-3.17.4 (31 Jan 2015)
+
+  31 Jan 2015; Lars Wendler <polynomial-c@gentoo.org> -nss-3.15.4.ebuild,
+  -nss-3.16.5.ebuild, -nss-3.16.6.ebuild, -nss-3.17.2.ebuild,
+  +nss-3.17.4.ebuild, -files/nss-3.15-gentoo-fixups.patch,
+  -files/nss-3.15-x32.patch:
+  Version bump (bug #538288). Removed old.
+

Vulnerable versions have been dropped. Sorry for the delay...
Comment 17 Yury German Gentoo Infrastructure gentoo-dev 2015-02-01 02:20:10 UTC
Maintainer(s), Thank you for cleanup!

Closing noglsa.