After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nsprUpgrade nspr-devel | May 4, 2022 | Jan 8, 2020 |
| Alpine Linux | — | Upgrade librewolfUpgrade nssUpgrade firefox | Aug 22, 2024 | Jan 8, 2020 |
| Amazon Linux Ami 2 | — | Upgrade nss-toolsUpgrade nspr-develUpgrade nss-sysinitUpgrade nssUpgrade nss-util-debuginfoUpgrade nss-softokn-debuginfoUpgrade nss-softokn-develUpgrade nss-softoknUpgrade nss-utilUpgrade nss-pkcs11-develUpgrade nss-softokn-freebl-develUpgrade nss-softokn-freeblUpgrade nss-util-develUpgrade nspr-debuginfoUpgrade nsprUpgrade nss-debuginfoUpgrade nss-devel | Nov 12, 2020 | Jan 8, 2020 |
| Amazon_linux | — | Upgrade nss-utilUpgrade nsprUpgrade nss-softokn | Jul 13, 2021 | Jan 8, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 8, 2020 |
| Centos_linux | — | Upgrade nss-softokn-freeblUpgrade nsprUpgrade nss-util-debuginfoUpgrade nss-utilUpgrade nss-toolsUpgrade nss-softokn-debuginfoUpgrade nssUpgrade nss-sysinitUpgrade nss-sysinit-debuginfoUpgrade nspr-debugsourceUpgrade nss-debugsourceUpgrade nspr-debuginfoUpgrade nss-pkcs11-develUpgrade nss-util-develUpgrade nss-tools-debuginfoUpgrade nss-softokn-freebl-debuginfoUpgrade nss-softokn-develUpgrade nspr-develUpgrade nss-debuginfoUpgrade nss-develUpgrade nss-softokn-freebl-develUpgrade nss-softokn | Aug 4, 2020 | Jan 8, 2020 |
| Debian | — | Upgrade nss | Jul 21, 2020 | Jan 8, 2020 |
| Mfsa2020 01 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 72.0 | Jan 8, 2020 | Jan 7, 2020 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 78.3.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 68.12.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade mail/thunderbird to version 78.3.0-11.4.27.0.1.82.0 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 78.3.0-11.4.27.0.1.82.0 on Solaris 11.4 | Jan 19, 2021 | Jan 8, 2020 |
| Oracle_linux | — | Upgrade nsprUpgrade nssUpgrade nss-utilUpgrade nss-softokn-freeblUpgrade nss-develUpgrade nss-toolsUpgrade nss-util-develUpgrade nss-sysinitUpgrade nss-softoknUpgrade nss-softokn-freebl-develUpgrade nspr-develUpgrade nss-pkcs11-develUpgrade nss-softokn-devel | Aug 5, 2020 | Jan 8, 2020 |
| Redhat_linux | — | Upgrade nss-debuginfoUpgrade nss-tools-debuginfoUpgrade nss-sysinitNo solution existsUpgrade nspr-debugsourceUpgrade nss-sysinit-debuginfoUpgrade nss-util-debuginfoUpgrade nss-toolsUpgrade nss-softokn-freebl-debuginfoUpgrade nss-develUpgrade nss-softokn-debuginfoUpgrade nss-softokn-freeblUpgrade nss-utilUpgrade nspr-develUpgrade nss-debugsourceUpgrade nss-pkcs11-develUpgrade nss-softokn-freebl-develUpgrade nss-softokn-develUpgrade nss-util-develUpgrade nss-softoknUpgrade nssUpgrade nspr-debuginfoUpgrade nspr | Aug 4, 2020 | Jan 8, 2020 |
| Rocky_linux | — | Upgrade nspr-debugsourceUpgrade nspr-debuginfoUpgrade nsprUpgrade nspr-devel | Mar 12, 2024 | Jan 8, 2020 |
| Ubuntu | — | Upgrade firefoxUpgrade libnss3 | Jan 10, 2020 | Jan 8, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub