nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade nss | Jul 30, 2024 | Jul 19, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 19, 2018 |
| Suse | — | Upgrade libfreebl3-hmacUpgrade mozilla-nspr-32bitUpgrade libsoftokn3-hmac-32bitUpgrade mozilla-nss-sysinitUpgrade mozilla-nsprUpgrade libsoftokn3-32bitUpgrade mozilla-nss-sysinit-32bitUpgrade libsoftokn3Upgrade java-1_8_0-openjdk-headlessUpgrade java-1_8_0-openjdk-demoUpgrade mozilla-nspr-develUpgrade MozillaFirefox-translationsUpgrade mozilla-nssUpgrade libfreebl3-32bitUpgrade libfreebl3Upgrade mozilla-nspr-x86Upgrade libsoftokn3-hmacUpgrade mozilla-nss-32bitUpgrade mozilla-nss-develUpgrade libfreebl3-x86Upgrade mozillafirefox-develUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nss-certsUpgrade java-1_8_0-openjdkUpgrade java-1_8_0-openjdk-develUpgrade mozillafirefoxUpgrade mozilla-nss-toolsUpgrade libsoftokn3-x86Upgrade mozilla-nss-x86Upgrade libfreebl3-hmac-32bit | Apr 21, 2017 | Apr 21, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub