Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2020-12403

Опубликовано: 27 июл. 2020
Источник: redhat
CVSS3: 7.4
EPSS Низкий

Описание

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 5nssOut of support scope
Red Hat Enterprise Linux 6nssOut of support scope
Red Hat Enterprise Linux 7nsprFixedRHSA-2020:407629.09.2020
Red Hat Enterprise Linux 7nssFixedRHSA-2020:407629.09.2020
Red Hat Enterprise Linux 7nss-softoknFixedRHSA-2020:407629.09.2020
Red Hat Enterprise Linux 7nss-utilFixedRHSA-2020:407629.09.2020
Red Hat Enterprise Linux 7.4 Advanced Update Supportnss-softoknFixedRHSA-2021:075809.03.2021
Red Hat Enterprise Linux 7.4 Telco Extended Update Supportnss-softoknFixedRHSA-2021:075809.03.2021
Red Hat Enterprise Linux 7.4 Update Services for SAP Solutionsnss-softoknFixedRHSA-2021:075809.03.2021
Red Hat Enterprise Linux 7.6 Extended Update SupportnssFixedRHSA-2021:087616.03.2021

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-125
https://bugzilla.redhat.com/show_bug.cgi?id=1868931nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read

EPSS

Процентиль: 41%
0.00191
Низкий

7.4 High

CVSS3

Связанные уязвимости

CVSS3: 9.1
ubuntu
больше 4 лет назад

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

CVSS3: 9.1
nvd
больше 4 лет назад

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

CVSS3: 9.1
msrc
больше 4 лет назад

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20 it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

CVSS3: 9.1
debian
больше 4 лет назад

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS i ...

CVSS3: 9.1
github
больше 3 лет назад

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

EPSS

Процентиль: 41%
0.00191
Низкий

7.4 High

CVSS3