CVE-2020-25648

HIGH

Network Security Services < 3.58 - Denial of Service via TLS 1.3 CCS Message Flood

Title source: llm
STIX 2.1

Description

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.

References (10)

Core 10
Core References
Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1887319
Not Applicable, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html

Scores

CVSS v3 7.5
EPSS 0.0010
EPSS Percentile 26.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-770
Status published
Products (9)
fedoraproject/fedora 31
fedoraproject/fedora 32
fedoraproject/fedora 33
mozilla/network_security_services < 3.58
oracle/communications_offline_mediation_controller 12.0.0.3.0
oracle/communications_pricing_design_center 12.0.0.3.0
oracle/jd_edwards_enterpriseone_tools < 9.2.6.0
redhat/enterprise_linux 7.0
redhat/enterprise_linux 8.0
Published Oct 20, 2020
Tracked Since Feb 18, 2026