{"id":"SUSE-SU-2026:5126-1","aliases":[],"status":"published","title":"Security update for mozilla-nss","description":"This update for mozilla-nss fixes the following issue:\n\n- remove compromised eMudhra Intermediates CA (bsc#1286261).\n\nChanges for mozilla-nss:\n\n- update to NSS 3.125.1 (bsc#1289144):\n * bmo#2088196 - backport nssckbi 2.92.\n * bmo#2082793 - Don't cache sessions when ECH was rejected.\n * bmo#2082792 - Keep DTLS handshake messages whole in the send buffer.\n * bmo#2082077 - Initialize sftk_MACCtx in sftk_MAC_Init.\n * bmo#2082027 - reorder session context setup in sftk_doMACInit.\n * bmo#2054723 - harden against integer overflows in lowpbe.c.\n * bmo#2054697 - fix AES GCM parameter serialization in pk11_GetPBECryptoMechanism.\n * bmo#2054695 - handle HMAC truncation when using PK11_Digest* APIs.\n * bmo#2054616 - reject short ciphertexts in sec_pkcs5_rc2.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-11-06T08:27:07Z","modified":"2026-11-07T11:30:04Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"mozilla-nss","fixed_in":["3.125.1-58.152.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"mozilla-nss","fixed_in":["3.125.1-58.152.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.125.1-58.152.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.125.1-58.152.1"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265126-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286261","tags":["report"]},{"url":"https://bugzilla.suse.com/1289144","tags":["report"]}],"sources":{"osv":[{"id":"SUSE-SU-2026:5126-1","title":"Security update for mozilla-nss","description":"This update for mozilla-nss fixes the following issue:\n\n- remove compromised eMudhra Intermediates CA (bsc#1286261).\n\nChanges for mozilla-nss:\n\n- update to NSS 3.125.1 (bsc#1289144):\n * bmo#2088196 - backport nssckbi 2.92.\n * bmo#2082793 - Don't cache sessions when ECH was rejected.\n * bmo#2082792 - Keep DTLS handshake messages whole in the send buffer.\n * bmo#2082077 - Initialize sftk_MACCtx in sftk_MAC_Init.\n * bmo#2082027 - reorder session context setup in sftk_doMACInit.\n * bmo#2054723 - harden against integer overflows in lowpbe.c.\n * bmo#2054697 - fix AES GCM parameter serialization in pk11_GetPBECryptoMechanism.\n * bmo#2054695 - handle HMAC truncation when using PK11_Digest* APIs.\n * bmo#2054616 - reject short ciphertexts in sec_pkcs5_rc2.\n","status":"published","published":"2026-11-06T08:27:07Z","modified":"2026-11-07T11:30:04.131592066Z","updated_at":"2026-11-07T11:45:54.882758Z"}]}}