Open Bug 1445511 Opened 7 years ago Updated 3 years ago

AES isn't clearing the key information in it's context when finished.

Categories

(NSS :: Libraries, enhancement, P3)

Product:
NSS
Component:
Libraries
Version:
3.38
Type:
enhancement

Tracking

(Not tracked)

People

(Reporter: rrelyea, Assigned: rrelyea)

Details

AES doesn't clear out the context data before it frees it in two places: AES_ContextDestroy in rijndael.c intel_AES_GCM_DestroyContext in intel-gcm-wrap.c
Priority: -- → P3
The downstream bug has a patch which we include in RHEL-7: https://bugzilla.redhat.com/show_bug.cgi?id=1555108 Bob, do you agree to upstream it?
Flags: needinfo?(rrelyea)
Yes, I'll take the bug.
Assignee: nobody → rrelyea
Flags: needinfo?(rrelyea)
QA Contact: franziskuskiefer
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.