CVE-2020-25648 — Allocation of Resources Without Limits or Throttling in Mozilla Network Security Services

CWE-770 — Allocation of Resources Without Limits or Throttling11 documents9 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 72.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Mozilla NSSMozilla Network Security ServicesOracle JD Edwards Enterpriseone Tools+4 more
Timeline
PublishedOct 20
Latest updateMay 24

Description

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶Debianmozilla/nss< 2:3.58-1+3
▶CVEListV5mozilla/nssnss versions before 3.58

Also affects: Fedora 31, 32, 33, Enterprise Linux 7.0, 8.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-43j5-76vw-pq2j: A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1↗2022-05-24
▶
CVEList
CVE-2020-25648: A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1↗2020-10-20
▶
OSV
CVE-2020-25648: A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1↗2020-10-20
▶

📋Vendor Advisories

5
Ubuntu
NSS vulnerability↗2022-05-11
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: Storage & Reporting (NSS) — CVE-2020-25648↗2021-10-15
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: CNE (NSS) — CVE-2020-25648↗2021-07-15
▶
Red Hat
nss: TLS 1.3 CCS flood remote DoS Attack↗2020-10-19
▶
Debian
CVE-2020-25648: nss - A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-25648 nss: TLS 1.3 CCS flood remote DoS Attack [fedora-all]↗2020-10-20
▶
Bugzilla
CVE-2020-25648 nss: TLS 1.3 CCS flood remote DoS Attack↗2020-10-12
▶
CVE-2020-25648 — Mozilla vulnerability | cvebase