CVE-2020-12403: Critical severity ibm cognos analytics vulnerability
A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.
Other sources
A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.
As per upstream:
Bug 1636771 (CVE-2020-12403) - Explicitly disable multi-part ChaCha20 (which was not functioning correctly) and more strictly enforce tag length. This was fixed in nss-3.55
Upstream bug: (currently private) https://bugzilla.mozilla.org/showbug.cgi?id=1636771
Upstream patchset: https://hg.mozilla.org/projects/nss/rev/f282556e6cc7715f5754aeaadda6f902590e7e38 https://hg.mozilla.org/projects/nss/rev/c25adfdfab34ddb08d3262aac3242e3399de1095
— Red Hat
Mozilla Network Security Services (NSS), as used in Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by the implementation of CHACHA20-POLY1305 decryption with undersized tag. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using multi-part Chacha20 to trigger an out-of-bounds read and obtain sensitive information.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-12403?
CVE-2020-12403 is a vulnerability in Mozilla Network Security Services (NSS) that can allow a remote attacker to obtain sensitive information.
How severe is CVE-2020-12403?
CVE-2020-12403 has a severity rating of 9.1 (Critical).
What is the affected software by CVE-2020-12403?
The affected software by CVE-2020-12403 includes Mozilla Firefox, IBM Cloud Pak for Security (CP4S), and Red Hat packages: nss, nspr, nss-softokn, and nss-util with specific versions.
How can a remote attacker exploit CVE-2020-12403?
A remote attacker can exploit CVE-2020-12403 by persuading a victim to visit a specially-crafted website.
Where can I find more information about CVE-2020-12403?
You can find more information about CVE-2020-12403 at the following references: [Link 1](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1636771), [Link 2](https://access.redhat.com/security/cve/CVE-2020-12403), [Link 3](https://bugzilla.mozilla.org/show_bug.cgi?id=1636771).