Denial of Service Vulnerability in NSS Package: CVE-2020-25648
Summary
ALPINE-CVE-2020-25648: A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. Affects nss versions < 3.58-r0. Fixed in 3.58-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NSS (Network Security Services) package is a set of libraries designed to support the development of security-enabled client and server applications. It provides essential functionalities such as SSL/TLS protocols, cryptographic operations, and certificate management. The NSS library is widely used in various applications to ensure secure communications. However, a flaw in its handling of ChangeCipherSpec (CCS) messages in TLS 1.3 has raised concerns about its stability and security.
Vulnerability Detail
A flaw was identified in the way NSS handled CCS messages in TLS 1.3, allowing a remote attacker to send multiple CCS messages. This could lead to a denial of service, making servers that utilize the NSS library unavailable. The vulnerability affects all versions of NSS prior to 3.58, posing a significant risk to system availability. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
3.58-r0
This is the first release that contains the fix.
sudo apk add --upgrade nssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected servers or implement network-level controls to mitigate the impact of potential denial-of-service attacks. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The CVE-2020-25648 vulnerability in the NSS package poses a significant risk to system availability due to its potential for denial of service. It is crucial to update to the patched version 3.58-r0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for nss →
FAQ
CVE-2020-25648 is a vulnerability in the NSS package that allows remote attackers to cause a denial of service by sending multiple ChangeCipherSpec messages.
This vulnerability can lead to system unavailability, affecting applications that rely on the NSS library for secure communications.
All versions of NSS prior to 3.58 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is impacted by this vulnerability without requiring any signup.
The CVSS score for CVE-2020-25648 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nss.
