nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
Weakness
The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Network_security_services | Mozilla | * | 3.30 (excluding) |
| Nss | Ubuntu | vivid/stable-phone-overlay | * |