Denial of Service in NSS library due to multiple CCS messages in TLS 1.3 (CVE-2020-25648)
Summary
CVE-2020-25648: A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. Affects nss versions < 3.58-r0. Fixed in 3.58-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NSS is a cryptographic library used by various applications to support SSL/TLS protocols. It provides functions for secure communication and encryption. The vulnerability identified as CVE-2020-25648 affects versions of NSS prior to 3.58. This vulnerability specifically impacts servers compiled with the NSS library and can lead to a denial of service (DoS) attack.
Vulnerability Detail
The flaw in NSS arises from the mishandling of ChangeCipherSpec (CCS) messages in TLS 1.3. An attacker can exploit this vulnerability by sending multiple CCS messages to the targeted server. This flood of CCS messages overwhelms the server, causing it to become unresponsive and resulting in a denial of service. The primary risk associated with this vulnerability is the potential disruption of system availability.
How To Fix
Minimum fixed version
3.58-r0
This is the first release that contains the fix.
sudo apk add --upgrade nssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. Applying the recommended fix by updating the NSS library is the most effective solution.
Conclusion
The vulnerability identified as CVE-2020-25648 in the NSS library can be exploited to launch a denial of service (DoS) attack on affected servers. To mitigate this risk, it is crucial to update the NSS library to version 3.58 or later. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for nss →
FAQ
NSS (Network Security Services) is a cryptographic library used by various applications to provide secure communication and encryption capabilities.
TLS 1.3 is the latest version of the Transport Layer Security protocol, which is used to establish secure connections over a network.
A ChangeCipherSpec (CCS) message is a part of the SSL/TLS handshake protocol that signals a change in the cipher suite to be used for encryption.
A denial of service (DoS) attack is an attempt to disrupt the normal functioning of a system or network by overwhelming it with a flood of illegitimate requests or data.
This vulnerability can lead to a denial of service (DoS) attack on servers compiled with the NSS library, causing them to become unresponsive and unavailable.
Related vulnerabilities
Recent vulnerabilities recorded for nss.
