The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected ciphertexts, the attacker would be able to decrypt a previously intercepted PKCS#1 v1.5 ciphertext (for example, to decrypt a TLS session that used RSA key exchange), or forge a signature using the victim's key. The issue was fixed by implementing the implicit rejection algorithm, in which the NSS returns a deterministic random message in case invalid padding is detected, as proposed in the Marvin Attack paper. This vulnerability affects NSS < 3.61.
El código NSS utilizado para comprobar PKCS#1 v1.5 estaba filtrando información útil para montar ataques tipo Bleichenbacher. Tanto la exactitud general del relleno como la longitud del mensaje cifrado se filtraban a través del canal lateral de sincronización. Al enviar una gran cantidad de textos cifrados seleccionados por el atacante, el atacante podría descifrar un texto cifrado PKCS#1 v1.5 previamente interceptado (por ejemplo, para descifrar una sesión TLS que utilizó el intercambio de claves RSA) o falsificar una firma utilizando el código de la víctima. llave. El problema se solucionó implementando el algoritmo de rechazo implícito, en el que NSS devuelve un mensaje aleatorio determinista en caso de que se detecte un relleno no válido, como se propone en el artículo de Marvin Attack. Esta vulnerabilidad afecta a NSS < 3.61.
USN-6727-1 fixed vulnerabilities in NSS. The update introduced a regression when trying to load security modules on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. This update fixes the problem. It was discovered that NSS incorrectly handled padding when checking PKCS#1 certificates. A remote attacker could possibly use this issue to perform Bleichenbacher-like attacks and recover private data. This issue only affected Ubuntu 20.04 LTS. It was discovered that NSS had a timing side-channel when performing RSA decryption. A remote attacker could possibly use this issue to recover private data. It was discovered that NSS had a timing side-channel when using certain NIST curves. A remote attacker could possibly use this issue to recover private data. The NSS package contained outdated CA certificates. This update refreshes the NSS package to version 3.98 which includes the latest CA certificate bundle and other security improvements.
