A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-nssalma-upgrade-nss-develalma-upgrade-nss-softoknalma-upgrade-nss-softokn-develalma-upgrade-nss-softokn-freeblalma-upgrade-nss-softokn-freebl-develalma-upgrade-nss-sysinitalma-upgrade-nss-toolsalma-upgrade-nss-utilalma-upgrade-nss-util-devel | May 4, 2022 | May 27, 2021 | |
| Alpine Linux | alpine-linux-upgrade-nss | Mar 26, 2024 | May 27, 2021 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-nspramazon-linux-ami-2-upgrade-nspr-debuginfoamazon-linux-ami-2-upgrade-nspr-develamazon-linux-ami-2-upgrade-nssamazon-linux-ami-2-upgrade-nss-debuginfoamazon-linux-ami-2-upgrade-nss-develamazon-linux-ami-2-upgrade-nss-pkcs11-develamazon-linux-ami-2-upgrade-nss-softoknamazon-linux-ami-2-upgrade-nss-softokn-debuginfoamazon-linux-ami-2-upgrade-nss-softokn-develamazon-linux-ami-2-upgrade-nss-softokn-freeblamazon-linux-ami-2-upgrade-nss-softokn-freebl-develamazon-linux-ami-2-upgrade-nss-sysinitamazon-linux-ami-2-upgrade-nss-toolsamazon-linux-ami-2-upgrade-nss-utilamazon-linux-ami-2-upgrade-nss-util-debuginfoamazon-linux-ami-2-upgrade-nss-util-devel | Nov 12, 2020 | Nov 12, 2020 | |
| Amazon_linux | — | amazon-linux-upgrade--nss-softoknamazon-linux-upgrade--nss-utilamazon-linux-upgrade-nspr | Jul 13, 2021 | Aug 27, 2020 |
| Centos_linux | — | centos-upgrade-nsprcentos-upgrade-nspr-debuginfocentos-upgrade-nspr-develcentos-upgrade-nsscentos-upgrade-nss-debuginfocentos-upgrade-nss-debugsourcecentos-upgrade-nss-develcentos-upgrade-nss-pkcs11-develcentos-upgrade-nss-softokncentos-upgrade-nss-softokn-debuginfocentos-upgrade-nss-softokn-develcentos-upgrade-nss-softokn-freeblcentos-upgrade-nss-softokn-freebl-debuginfocentos-upgrade-nss-softokn-freebl-develcentos-upgrade-nss-sysinitcentos-upgrade-nss-sysinit-debuginfocentos-upgrade-nss-toolscentos-upgrade-nss-tools-debuginfocentos-upgrade-nss-utilcentos-upgrade-nss-util-debuginfocentos-upgrade-nss-util-devel | Oct 1, 2020 | Sep 29, 2020 |
| Debian | debian-upgrade-nss | Oct 1, 2020 | Oct 1, 2020 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-libs-nss | Aug 20, 2020 | Aug 19, 2020 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-nss-softoknhuawei-euleros-2_0_sp8-upgrade-nss-softokn-develhuawei-euleros-2_0_sp8-upgrade-nss-softokn-freeblhuawei-euleros-2_0_sp8-upgrade-nss-softokn-freebl-devel | Dec 15, 2020 | Dec 1, 2020 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-nsshuawei-euleros-2_0_sp9-upgrade-nss-softoknhuawei-euleros-2_0_sp9-upgrade-nss-util | Dec 1, 2020 | Dec 1, 2020 | |
| Nutanix Ahv | nutanix-ahv-upgrade-latest | Jun 5, 2026 | Sep 19, 2022 | |
| Oracle_linux | — | oracle-linux-upgrade-nsproracle-linux-upgrade-nspr-develoracle-linux-upgrade-nssoracle-linux-upgrade-nss-develoracle-linux-upgrade-nss-pkcs11-develoracle-linux-upgrade-nss-softoknoracle-linux-upgrade-nss-softokn-develoracle-linux-upgrade-nss-softokn-freebloracle-linux-upgrade-nss-softokn-freebl-develoracle-linux-upgrade-nss-sysinitoracle-linux-upgrade-nss-toolsoracle-linux-upgrade-nss-utiloracle-linux-upgrade-nss-util-devel | Oct 9, 2020 | Jul 27, 2020 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-nsprredhat-upgrade-nspr-debuginforedhat-upgrade-nspr-develredhat-upgrade-nssredhat-upgrade-nss-debuginforedhat-upgrade-nss-debugsourceredhat-upgrade-nss-develredhat-upgrade-nss-pkcs11-develredhat-upgrade-nss-softoknredhat-upgrade-nss-softokn-debuginforedhat-upgrade-nss-softokn-develredhat-upgrade-nss-softokn-freeblredhat-upgrade-nss-softokn-freebl-debuginforedhat-upgrade-nss-softokn-freebl-develredhat-upgrade-nss-sysinitredhat-upgrade-nss-sysinit-debuginforedhat-upgrade-nss-toolsredhat-upgrade-nss-tools-debuginforedhat-upgrade-nss-utilredhat-upgrade-nss-util-debuginforedhat-upgrade-nss-util-devel | Oct 1, 2020 | Sep 29, 2020 | |
| Rocky_linux | rocky-upgrade-nssrocky-upgrade-nss-debuginforocky-upgrade-nss-debugsourcerocky-upgrade-nss-develrocky-upgrade-nss-softoknrocky-upgrade-nss-softokn-debuginforocky-upgrade-nss-softokn-develrocky-upgrade-nss-softokn-freeblrocky-upgrade-nss-softokn-freebl-debuginforocky-upgrade-nss-softokn-freebl-develrocky-upgrade-nss-sysinitrocky-upgrade-nss-sysinit-debuginforocky-upgrade-nss-toolsrocky-upgrade-nss-tools-debuginforocky-upgrade-nss-utilrocky-upgrade-nss-util-debuginforocky-upgrade-nss-util-devel | Mar 12, 2024 | May 27, 2021 | |
| Suse | — | suse-upgrade-libfreebl3suse-upgrade-libfreebl3-32bitsuse-upgrade-libfreebl3-hmacsuse-upgrade-libfreebl3-hmac-32bitsuse-upgrade-libsoftokn3suse-upgrade-libsoftokn3-32bitsuse-upgrade-libsoftokn3-hmacsuse-upgrade-libsoftokn3-hmac-32bitsuse-upgrade-mozilla-nsprsuse-upgrade-mozilla-nspr-32bitsuse-upgrade-mozilla-nspr-develsuse-upgrade-mozilla-nsssuse-upgrade-mozilla-nss-32bitsuse-upgrade-mozilla-nss-certssuse-upgrade-mozilla-nss-certs-32bitsuse-upgrade-mozilla-nss-develsuse-upgrade-mozilla-nss-sysinitsuse-upgrade-mozilla-nss-sysinit-32bitsuse-upgrade-mozilla-nss-tools | Sep 17, 2021 | Aug 27, 2020 |
| Ubuntu | ubuntu-pro-upgrade-libnss3ubuntu-upgrade-libnss3 | Aug 28, 2020 | Aug 27, 2020 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | May 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub