CVE-2021-43527: 
NixOS vulnerability analysis and mitigation

CVE-2021-43527 affects Network Security Services (NSS) versions prior to 3.73 or 3.68.1 ESR. The vulnerability is a heap overflow that occurs when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. The vulnerability was discovered in December 2021 (Mozilla Security, NVD).

The vulnerability is a memory corruption flaw in the way NSS verifies certificates. The issue occurs in the decodeECorDsaSignature function when processing DER-encoded DSA or RSA-PSS signatures. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Red Hat, Hacker News).

A successful exploit could lead to remote code execution when a client application compiled with NSS tries to initiate an SSL/TLS connection to a malicious server. Similarly, server applications compiled with NSS that process client certificates can be triggered by receiving a malicious certificate. The vulnerability affects both server applications (like Red Hat Identity Management, Red Hat Directory Server) and client applications using the NSS crypto library (Red Hat).

The primary mitigation is to update to NSS version 3.73 or 3.68.1 ESR. There are no effective workarounds, and customers should update to fixed packages as soon as they become available. Various vendors have released patches for their affected products, including Red Hat Enterprise Linux, Oracle, and others (Red Hat).

The vulnerability received significant attention due to its critical severity and wide impact across multiple products. Security researchers noted that the vulnerability had existed since June 2012 and survived multiple code refactoring cycles. Google Project Zero researcher Tavis Ormandy, who discovered the vulnerability, described it as a 'striking' example of how even well-maintained C/C++ code can contain serious flaws (Hacker News).