CVE-2011-5094

Publication date 16 June 2012

Last updated 4 August 2025

Ubuntu priority

Low

Why this priority?

Description

Mozilla Network Security Services (NSS) 3.x, with certain settings of the SSL_ENABLE_RENEGOTIATION option, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-1473. NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment

Read the notes from the security team

Status

Package Ubuntu Release Status
nss 12.04 LTS precise Ignored end of life
11.10 oneiric Ignored end of life
11.04 natty Ignored end of life
10.04 LTS lucid Ignored end of life
8.04 LTS hardy Ignored end of life

Notes

mdeslaur

this CVE is specific to nss, openssl is in CVE-2011-1473 Upstream disputes this. Ignoring.

References

Other references