CVE-2016-8635 It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining th...
MediumCVSS 5.9
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nss(Debian:12) | < 2:3.25-1 | 2:3.25-1 |
| debian/nss(Debian:13) | < 2:3.25-1 | 2:3.25-1 |
| debian/nss(Debian:14) | < 2:3.25-1 | 2:3.25-1 |
| mozilla network security services | >= 3.21, <= 3.21.4 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| mozilla nss | = 3.21.x | No fix listed |
References
- Debian Security Tracker CVE-2016-8635 vendor-advisory
- RHSA-2016:2779 third-party-advisory vendor-advisory
- 94346 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- GLSA-201701-46 third-party-advisory vendor-advisory