CVE-2020-12403

Katalog CVE

CVSS 9.1 · Critical EPSS 1,5%

Kerentanan Out-of-bounds Read pada mozilla nss. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Rincian

Terbit di NVD

27 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes release notes · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=1868931 issue tracking · patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html
• https://security.netapp.com/advisory/ntap-20230324-0006/