CVE-2020-25648
High
Description
A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Mozilla Network Security Services
PublishedOct 20, 2020
First seenOct 20, 2020
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- mozilla network_security_services3.58 or later
- oracle jd_edwards_enterpriseone_tools9.2.6.0 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RPOLN6DJUYQ3QBQEGLZGV73SNIPK7GHV/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRM53IQCPZT2US3M7JXTP6I6IBA5RGOD/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERA5SVJQXQMDGES7RIT4F4NQVLD35RXN/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla network_security_services | v < 3.58 | 3.58 |
| redhat enterprise_linux | 7.0, 8.0 | — |
| fedoraproject fedora | 31, 32, 33 | — |
| oracle communications_offline_mediation_controller | 12.0.0.3.0 | — |
| oracle communications_pricing_design_center | 12.0.0.3.0 | — |
| oracle jd_edwards_enterpriseone_tools | v < 9.2.6.0 | 9.2.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.