CVE-2020-25648: High severity ibm cognos analytics vulnerability
A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.
Other sources
Mozilla Network Security Services (NSS), as used in Mozilla Firefox is vulnerable to a denial of service, caused by improper handling of CCS (ChangeCipherSpec) messages in TLS. By sending specially-crafted CCS messages, a remote attacker could exploit this vulnerability to cause the system to crash.
— IBM
NSS allows an attacker to send CCS messages in a row after ClientHello message. If an attacker put multiple CCS messages in a single tcp packet, the NSS server will stuck in a loop for many times to process the messages.
This issue affects servers which are compiled against the NSS library. Other consumers of NSS like firefox etc are not affected by this flaw.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-25648?
CVE-2020-25648 is a vulnerability in Mozilla Network Security Services (NSS) as used in Mozilla Firefox that allows a remote attacker to cause a denial of service (DoS) for servers compiled with the NSS library.
What is the severity of CVE-2020-25648?
The severity of CVE-2020-25648 is high, with a CVSS score of 7.5.
Which systems or software are affected by CVE-2020-25648?
Systems or software compiled with the NSS library versions up to and excluding 3.58 are affected, including Redhat Enterprise Linux 7.0 and 8.0, Fedora 31, 32, and 33, Oracle Communications Offline Mediation Controller 12.0.0.3.0, Oracle Communications Pricing Design Center 12.0.0.3.0, and IBM Cloud Pak for Security (CP4S) versions up to and including 1.7.2.0, 1.7.1.0, and 1.7.0.0.
How does CVE-2020-25648 impact system availability?
CVE-2020-25648 can cause a denial of service (DoS) for servers compiled with the vulnerable NSS library versions.
Where can I find more information about CVE-2020-25648?
More information about CVE-2020-25648 can be found at the following references: [link1](https://hg.mozilla.org/projects/nss/rev/57bbefa793232586d27cee83e74411171e128361), [link2](https://bugzilla.mozilla.org/show_bug.cgi?id=1641480), [link3](https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.58_release_notes).