CVE-2020-12403

State: Published
Severity: Not scored
Published: May 27, 2021
Updated: Aug 4, 2024
Reserved: Apr 28, 2020

Description

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Scores

The record has no CVSS score.

Weaknesses

CWE-125

Affected Products

Product	Versions
nssn/a	nss 3.55Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1868931
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes
[debian-lts-announce] 20230220 [SECURITY] [DLA 3327-1] nss security updatemailing-list
https://security.netapp.com/advisory/ntap-20230324-0006/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.