nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade nss | Jul 30, 2024 | Jul 19, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 19, 2018 |
| Suse | — | Upgrade java-1_8_0-openjdk-headlessUpgrade mozilla-nsprUpgrade mozilla-nss-sysinit-32bitUpgrade libfreebl3-hmacUpgrade java-1_8_0-openjdk-demoUpgrade mozilla-nspr-develUpgrade libsoftokn3Upgrade MozillaFirefoxUpgrade MozillaFirefox-develUpgrade libsoftokn3-32bitUpgrade mozilla-nss-sysinitUpgrade mozilla-nspr-32bitUpgrade libsoftokn3-hmac-32bitUpgrade libsoftokn3-x86Upgrade libfreebl3-hmac-32bitUpgrade mozilla-nss-certsUpgrade mozilla-nss-toolsUpgrade mozilla-nss-32bitUpgrade mozilla-nspr-x86Upgrade MozillaFirefox-translationsUpgrade libfreebl3-x86Upgrade mozilla-nss-develUpgrade mozilla-nss-certs-32bitUpgrade libfreebl3Upgrade libsoftokn3-hmacUpgrade libfreebl3-32bitUpgrade mozilla-nss-x86Upgrade java-1_8_0-openjdk-develUpgrade mozilla-nssUpgrade java-1_8_0-openjdk | Apr 21, 2017 | Apr 21, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub