CVE-2019-17023
Public on 2020-01-08
Modified on 2021-07-12
Description
A protocol downgrade flaw was found in Network Security Services (NSS). After a HelloRetryRequest has been sent, the client may negotiate a lower protocol than TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored.
Severity
Low
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 1 | nspr | 2021-07-08 | ALAS-2021-1522 | Fixed |
| Amazon Linux 2 - Core | nspr | 2020-11-09 | ALAS2-2020-1559 | Fixed |
| Amazon Linux 2 - Core | nss | 2020-11-09 | ALAS2-2020-1559 | Fixed |
| Amazon Linux 1 | nss-softokn | 2021-07-08 | ALAS-2021-1522 | Fixed |
| Amazon Linux 2 - Core | nss-softokn | 2020-11-09 | ALAS2-2020-1559 | Fixed |
| Amazon Linux 1 | nss-util | 2021-07-08 | ALAS-2021-1522 | Fixed |
| Amazon Linux 2 - Core | nss-util | 2020-11-09 | ALAS2-2020-1559 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N |
| NVD | CVSSv2 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| NVD | CVSSv3 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |