CVE-2016-8635 Weak cryptography in nss
An attacker can recover private keys by exploiting a small subgroup confinement flaw in the Diffie Hellman key exchange of the NSS library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-8635?
CVE-2016-8635 is a medium-severity vulnerability in Mozilla Network Security Services, published on 1 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.
Which versions are affected by CVE-2016-8635?
It affects 7 products.
Products include Mozilla Network Security Services, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus, Redhat Enterprise Linux Server Tus and 1 more.
How do I fix CVE-2016-8635?
Upgrade to a fixed version.
Is CVE-2016-8635 being exploited?
There is no known exploitation of CVE-2016-8635 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Network Security Services
Sources
Also known as DEBIAN-CVE-2016-8635, GHSA-j6rc-c6gr-mf89, UBUNTU-CVE-2016-8635.