The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic.
CVSS Details
- CVSS 3.1 Base Score: 4.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nss | Aug 30, 2017 | Jan 18, 2014 |
| Centos_linux | — | Upgrade nss-develUpgrade nss-sysinitUpgrade nss-util-develUpgrade nss-toolsUpgrade nssUpgrade nss-pkcs11-develUpgrade nspr-develUpgrade nss-utilUpgrade nspr | Dec 1, 2016 | Jan 18, 2014 |
| Debian | — | Upgrade nss | Jul 30, 2024 | Jan 18, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 17, 2015 |
| Oracle_linux | — | Upgrade nss-util-develUpgrade nspr-develUpgrade nss-sysinitUpgrade nsprUpgrade nss-toolsUpgrade nssUpgrade nss-pkcs11-develUpgrade nss-develUpgrade nss-util | Oct 16, 2024 | Jan 18, 2014 |
| Suse | — | Upgrade libfreebl3-32bitUpgrade mozilla-nss-32bitUpgrade libsoftokn3-hmac-32bitUpgrade mozilla-nss-certsUpgrade libfreebl3-hmac-32bitUpgrade mozilla-nss-certs-32bitUpgrade libfreebl3-hmacUpgrade libsoftokn3-hmacUpgrade libsoftokn3Upgrade mozilla-nss-toolsUpgrade libsoftokn3-32bitUpgrade mozilla-nss-sysinitUpgrade mozilla-nss-sysinit-32bitUpgrade libfreebl3Upgrade mozilla-nssUpgrade mozilla-nss-devel | Aug 9, 2024 | Jan 18, 2014 |
| Ubuntu | — | Upgrade libnss3-1dUpgrade libnss3 | Nov 8, 2024 | Jan 18, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub