topic Are Check Point appliances vulnerable to Red-Hat CVE-2021-435? in General Topics

Are Check Point appliances vulnerable to Red-Hat CVE-2021-435?

Ruan_Kotze — Tue, 07 Dec 2021 12:02:16 GMT

Hi All,

Pretty much what the subject says, RH have identified a critical vulnerability (remote code execution flaw) in NSS as per https://access.redhat.com/security/cve/CVE-2021-43527

If I understand the R81 hardening guide correctly, it lists NSS as one of the RPM's that's unchanged in Gaia. Is this something that needs to be patched by Check Point?

I did log a ticket with TAC, but thought I would ask / share here as well while I wait for an official answer from them.

Ruan

Re: Are Check Point appliances vulnerable to Red-Hat CVE-2021-435?

_Val_ — Tue, 07 Dec 2021 13:36:18 GMT

Hi @Ruan_Kotze, R&D is looking into this. The official response will be provided shortly.

Re: Are Check Point appliances vulnerable to Red-Hat CVE-2021-435?

_Val_ — Thu, 09 Dec 2021 07:39:29 GMT

Hi @Ruan_Kotze and all. Here is the official response:

We have carefully reviewed the situation, and found that while the vulnerable NSS package exists on Gaia, there is no direct use of it in any of our products.

Therefore, Check Point Gaia is not vulnerable to CVE-2021-43527.

Having said that, we are working on upgrading the NSS package to a version that isn’t vulnerable.