CVE-2020-12403 is a critical vulnerability affecting Mozilla NSS versions prior to 3.55, stemming from an out-of-bounds read flaw in the CHACHA20-POLY1305 implementation when using multi-part ChaCha20. With a CVSS score of 9.1, this vulnerability presents a high threat to confidentiality and system availability, requiring no user interaction or authentication for exploitation over the network. While no active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB) has been identified, and community discussion is minimal, the flaw is categorized as CWE-125 (Out-of-bounds Read). The issue was resolved by disabling faulty multi-part ChaCha20 and enforcing strict tag length.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.55CPE matchmatch criteria | cpe:2.3:a:mozilla:nss:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20 it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.
May 11, 2021nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read
Jul 27, 2020