CVE-2016-8635

Se ha descubierto que el manejo del intercambio de claves de cliente Diffie Hellman en NSS 3.21.x era vulnerable a un ataque de confinamiento de subgrupo pequeño. Un atacante podría emplear este error para recuperar claves privadas confinando la clave DH del cliente en un subgrupo pequeño del grupo deseado.

It was found that Diffie Hellman Client key exchange handling in NSS was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.

An update that fixes 29 vulnerabilities is now available. Mozilla Firefox was updated to the Firefox ESR release 45.9. Mozilla NSS was updated to support TLS 1.3 and various new ciphers, PRFs, Diffie Hellman key agreement and support for more hashes. Security issues fixed in Firefox code Firefox ESR 45.9, and Firefox ESR 52.1 XSLT processing processing Graphite 2 in the editor manipulation are sent with incorrect data application/http-index-format content application/http-index-format content destructor during XSLT processing events Mozilla NSS was updated to 3.29.5, bringing new features and fixing bugs.