rpms/nss
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

[security][HIGH] nss 3.111: 4 CVE require triage #1

New issue
Open
opened 2026-05-25 00:46:42 +03:00 by sbelikov · 0 comments
sbelikov commented 2026-05-25 00:46:42 +03:00
Owner
Copy link

CVE triage request / Запрос на разбор CVE

Package / Пакет

  • Package: nss
  • Version: 3.111
  • EVR: 3.111-1
  • Category: -
  • Policy class: -
  • NiceOS policy class: -
  • Owner: -
  • Severity: HIGH
  • Max CVSS: 7.8
  • CVE count: 4

LLM recommendation / Рекомендация LLM

RU

Для пакета nss 3.111 найдены CVE-кандидаты по данным NVD/CPE: CVE-2017-11695, CVE-2017-11696, CVE-2017-11697, CVE-2017-11698. Требуется triage security-team.

Проверить применимость CVE к сборке НАЙС.ОС, сопоставить с upstream/vendor advisory, определить статус affected/fixed/not_affected и при необходимости подготовить обновление пакета.

Рекомендуемое действие: needs_triage

Подсказка по целевой версии: -

Проверки: Проверить сборку RPM, обновление пакета, совместимость зависимостей, service/CLI smoke tests и регрессионные сценарии по классу пакета.

Риски: Автоматическое совпадение NVD/CPE не является финальным вердиктом по НАЙС.ОС.

EN

NVD/CPE candidate CVEs were found for nss 3.111: CVE-2017-11695, CVE-2017-11696, CVE-2017-11697, CVE-2017-11698. Security-team triage is required.

Verify CVE applicability to the NiceOS build, compare with upstream/vendor advisories, set affected/fixed/not_affected status, and prepare a package update if required.

Recommended action: needs_triage

Target version hint: -

Tests: Run RPM build, package upgrade, dependency compatibility, service/CLI smoke tests, and package-class-specific regression tests.

Risks: An automatic NVD/CPE match is not the final NiceOS vulnerability verdict.

CVE candidates from NVD/CPE

CVE Severity CVSS Match NiceOS status Reason
CVE-2017-11695 HIGH 7.8 cpe-generic needs_triage generic CPE product match without version range; needs triage
CVE-2017-11696 HIGH 7.8 cpe-generic needs_triage generic CPE product match without version range; needs triage
CVE-2017-11697 HIGH 7.8 cpe-generic needs_triage generic CPE product match without version range; needs triage
CVE-2017-11698 HIGH 7.8 cpe-generic needs_triage generic CPE product match without version range; needs triage

Descriptions

CVE-2017-11695

Heap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.

CVE-2017-11696

Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.

CVE-2017-11697

The __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of service (floating point exception and crash) via a crafted cert8.db file.

CVE-2017-11698

Heap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.

Maintainer checklist

  • Verify whether each CVE applies to the NiceOS build.
  • Compare NVD data with upstream/vendor advisory.
  • Set final NiceOS status: affected, fixed, not_affected, false_positive, deferred, or not_in_cloud_image.
  • If affected, decide update/backport strategy according to package policy class.
  • Run package-class-specific build, upgrade and regression tests.
  • Add/update niceos_cve_triage entry.
  • Create NICE-SA advisory if a security update is shipped.

Machine metadata

{
  "cves": [
    "CVE-2017-11695",
    "CVE-2017-11696",
    "CVE-2017-11697",
    "CVE-2017-11698"
  ],
  "fingerprint": "044016337c714f0a3741",
  "generated_at": "2026-05-24T21:46:42Z",
  "package": "nss",
  "prompt_version": "niceos_cve_issue_analysis_v1",
  "tool": "niceos_cve_create_issues.py",
  "tool_version": "1.0",
  "version": "3.111"
}
<!-- niceos-cve-fingerprint: 044016337c714f0a3741 --> # CVE triage request / Запрос на разбор CVE ## Package / Пакет - Package: `nss` - Version: `3.111` - EVR: `3.111-1` - Category: `-` - Policy class: `-` - NiceOS policy class: `-` - Owner: `-` - Severity: `HIGH` - Max CVSS: `7.8` - CVE count: `4` ## LLM recommendation / Рекомендация LLM ### RU Для пакета nss 3.111 найдены CVE-кандидаты по данным NVD/CPE: CVE-2017-11695, CVE-2017-11696, CVE-2017-11697, CVE-2017-11698. Требуется triage security-team. Проверить применимость CVE к сборке НАЙС.ОС, сопоставить с upstream/vendor advisory, определить статус affected/fixed/not_affected и при необходимости подготовить обновление пакета. **Рекомендуемое действие:** `needs_triage` **Подсказка по целевой версии:** `-` **Проверки:** Проверить сборку RPM, обновление пакета, совместимость зависимостей, service/CLI smoke tests и регрессионные сценарии по классу пакета. **Риски:** Автоматическое совпадение NVD/CPE не является финальным вердиктом по НАЙС.ОС. ### EN NVD/CPE candidate CVEs were found for nss 3.111: CVE-2017-11695, CVE-2017-11696, CVE-2017-11697, CVE-2017-11698. Security-team triage is required. Verify CVE applicability to the NiceOS build, compare with upstream/vendor advisories, set affected/fixed/not_affected status, and prepare a package update if required. **Recommended action:** `needs_triage` **Target version hint:** `-` **Tests:** Run RPM build, package upgrade, dependency compatibility, service/CLI smoke tests, and package-class-specific regression tests. **Risks:** An automatic NVD/CPE match is not the final NiceOS vulnerability verdict. ## CVE candidates from NVD/CPE | CVE | Severity | CVSS | Match | NiceOS status | Reason | |---|---|---:|---|---|---| | CVE-2017-11695 | HIGH | 7.8 | cpe-generic | needs_triage | generic CPE product match without version range; needs triage | | CVE-2017-11696 | HIGH | 7.8 | cpe-generic | needs_triage | generic CPE product match without version range; needs triage | | CVE-2017-11697 | HIGH | 7.8 | cpe-generic | needs_triage | generic CPE product match without version range; needs triage | | CVE-2017-11698 | HIGH | 7.8 | cpe-generic | needs_triage | generic CPE product match without version range; needs triage | ## Descriptions ### CVE-2017-11695 Heap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file. ### CVE-2017-11696 Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file. ### CVE-2017-11697 The __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of service (floating point exception and crash) via a crafted cert8.db file. ### CVE-2017-11698 Heap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file. ## Maintainer checklist - [ ] Verify whether each CVE applies to the NiceOS build. - [ ] Compare NVD data with upstream/vendor advisory. - [ ] Set final NiceOS status: `affected`, `fixed`, `not_affected`, `false_positive`, `deferred`, or `not_in_cloud_image`. - [ ] If affected, decide update/backport strategy according to package policy class. - [ ] Run package-class-specific build, upgrade and regression tests. - [ ] Add/update `niceos_cve_triage` entry. - [ ] Create `NICE-SA` advisory if a security update is shipped. ## Machine metadata ```json { "cves": [ "CVE-2017-11695", "CVE-2017-11696", "CVE-2017-11697", "CVE-2017-11698" ], "fingerprint": "044016337c714f0a3741", "generated_at": "2026-05-24T21:46:42Z", "package": "nss", "prompt_version": "niceos_cve_issue_analysis_v1", "tool": "niceos_cve_create_issues.py", "tool_version": "1.0", "version": "3.111" } ```
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
niceos-5.2
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
rpms/nss#1
No description provided.