CVE-2019-17023

Description

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
• v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 0.89%• Percentile: 76%

Techniques & Countermeasures

• CWE-287•Improper Authentication

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Systems

• canonical•ubuntu_linux

  16.04 | 18.04 | 19.04 | 19.10 | 20.04

• debian•debian_linux

  10.0

• mozilla•firefox

  < 72.0 | < 72

References (5)

• https://bugzilla.mozilla.org/show_bug.cgi?id=1590001
• https://www.mozilla.org/security/advisories/mfsa2020-01/
• https://usn.ubuntu.com/4234-1/
• https://usn.ubuntu.com/4397-1/
• https://www.debian.org/security/2020/dsa-4726