PatchTheCVEmod nss vulnerabilities and fixes
Recent CVEs affecting mod nss, with upgrade or downgrade steps. 3 tracked.
Also searched as: modnss.
mod nss has 3 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 2. Most recent: 2018-02-15. Highest priority: CVE-2015-5244 (score 61/100).
- CVE-2015-5244 CRITICAL 9.8 UPGRADE The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass
- CVE-2015-3277 HIGH 7.5 UPGRADE The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect par
- CVE-2011-4973 CRITICAL 9.8 DOWNGRADE Authentication bypass vulnerability in mod_nss 1.0.8 allows remote attackers to assume the identity of a valid
FAQ
How do I fix mod nss vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mod nss being exploited right now?
None of the tracked mod nss CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mod nss CVE should I patch first?
CVE-2015-5244 currently ranks highest (61/100): The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass.