nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade nss | Jul 30, 2024 | Jul 19, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 19, 2018 |
| Suse | — | Upgrade mozilla-nss-32bitUpgrade java-1_8_0-openjdkUpgrade libsoftokn3-x86Upgrade mozilla-nss-certs-32bitUpgrade mozillafirefox-develUpgrade mozilla-nssUpgrade mozilla-nss-develUpgrade mozilla-nss-toolsUpgrade mozillafirefoxUpgrade libfreebl3-x86Upgrade libfreebl3Upgrade mozilla-nss-certsUpgrade mozilla-nspr-x86Upgrade libfreebl3-hmac-32bitUpgrade java-1_8_0-openjdk-develUpgrade mozilla-nss-x86Upgrade libsoftokn3-hmacUpgrade libfreebl3-32bitUpgrade MozillaFirefox-translationsUpgrade mozilla-nss-sysinit-32bitUpgrade mozilla-nsprUpgrade libfreebl3-hmacUpgrade mozilla-nspr-develUpgrade mozilla-nss-sysinitUpgrade mozilla-nspr-32bitUpgrade libsoftokn3-hmac-32bitUpgrade java-1_8_0-openjdk-demoUpgrade libsoftokn3Upgrade java-1_8_0-openjdk-headlessUpgrade libsoftokn3-32bit | Apr 21, 2017 | Apr 21, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub