by Kastro
Paper/Archive/CVE-2020-12403

CVE-2020-12403

mozilla — A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55.

EPSS 2%CVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 74.9.749 × 2015.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Affected

ProductAffectedFixed inSource
nssnss 3.55–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

refbugzilla.redhat.com/show_bug.cgi?id=1868931refdeveloper.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notesreflists.debian.org/debian-lts-announce/2023/02/msg00021.htmlrefsecurity.netapp.com/advisory/ntap-20230324-0006