After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.
Weakness
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Firefox | Mozilla | * | 72.0 (excluding) |
| Red Hat Enterprise Linux 7 | RedHat | nspr-0:4.25.0-2.el7_9 | * |
| Red Hat Enterprise Linux 7 | RedHat | nss-0:3.53.1-3.el7_9 | * |
| Red Hat Enterprise Linux 7 | RedHat | nss-softokn-0:3.53.1-6.el7_9 | * |
| Red Hat Enterprise Linux 7 | RedHat | nss-util-0:3.53.1-1.el7_9 | * |
| Red Hat Enterprise Linux 8 | RedHat | nspr-0:4.25.0-2.el8_2 | * |
| Red Hat Enterprise Linux 8 | RedHat | nss-0:3.53.1-11.el8_2 | * |
| Red Hat OpenShift Do | RedHat | openshiftdo/odo-init-image-rhel7:1.1.3-2 | * |
| Firefox | Ubuntu | bionic | * |
| Firefox | Ubuntu | devel | * |
| Firefox | Ubuntu | disco | * |
| Firefox | Ubuntu | eoan | * |
| Firefox | Ubuntu | focal | * |
| Firefox | Ubuntu | trusty | * |
| Firefox | Ubuntu | upstream | * |
| Firefox | Ubuntu | xenial | * |
| Nss | Ubuntu | bionic | * |
| Nss | Ubuntu | disco | * |
| Nss | Ubuntu | eoan | * |
| Nss | Ubuntu | esm-infra/bionic | * |
| Nss | Ubuntu | trusty | * |
| Nss | Ubuntu | upstream | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/114.html
- https://cwe.mitre.org/data/definitions/115.html
- https://cwe.mitre.org/data/definitions/151.html
- https://cwe.mitre.org/data/definitions/194.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/57.html
- https://cwe.mitre.org/data/definitions/593.html
- https://cwe.mitre.org/data/definitions/633.html
- https://cwe.mitre.org/data/definitions/650.html
- https://cwe.mitre.org/data/definitions/94.html
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1590001
- https://usn.ubuntu.com/4234-1/
- https://usn.ubuntu.com/4397-1/
- https://www.debian.org/security/2020/dsa-4726
- https://www.mozilla.org/security/advisories/mfsa2020-01/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1590001
- https://usn.ubuntu.com/4234-1/
- https://usn.ubuntu.com/4397-1/
- https://www.debian.org/security/2020/dsa-4726
- https://www.mozilla.org/security/advisories/mfsa2020-01/