CVE-2013-1740

2014-01-1822:55:00

CWE-310

[email protected]

web.nvd.nist.gov

nss

ssl

handshake vulnerability

cve-2013-1740

nvd

7.4 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

48.4%

JSON

The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic.

CPENameOperatorVersion
mozilla:network_security_servicesmozilla network security serviceseq3.11.2
mozilla:network_security_servicesmozilla network security serviceseq3.6.1
mozilla:network_security_servicesmozilla network security serviceseq3.12.5
mozilla:network_security_servicesmozilla network security serviceseq3.2
mozilla:network_security_servicesmozilla network security serviceseq3.15
mozilla:network_security_servicesmozilla network security serviceseq3.11.4
mozilla:network_security_servicesmozilla network security serviceseq3.7.7
mozilla:network_security_servicesmozilla network security serviceseq3.14.1
mozilla:network_security_servicesmozilla network security serviceseq3.7.5
mozilla:network_security_servicesmozilla network security serviceseq3.7.1

CPE	Name	Operator	Version
mozilla:network_security_services	mozilla network security services	eq	3.11.2
mozilla:network_security_services	mozilla network security services	eq	3.6.1
mozilla:network_security_services	mozilla network security services	eq	3.12.5
mozilla:network_security_services	mozilla network security services	eq	3.2
mozilla:network_security_services	mozilla network security services	eq	3.15
mozilla:network_security_services	mozilla network security services	eq	3.11.4
mozilla:network_security_services	mozilla network security services	eq	3.7.7
mozilla:network_security_services	mozilla network security services	eq	3.14.1
mozilla:network_security_services	mozilla network security services	eq	3.7.5
mozilla:network_security_services	mozilla network security services	eq	3.7.1