Vulnerability CVE-2019-17023: Information

Description

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-17023
Published: Jan. 9, 2020
Modified: Jan. 27, 2023
Error type identifier: CWE-287

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus72.0.2-alt1125.0.3-alt1ALT-PU-2020-1110-1244791Fixed
firefoxp1072.0.2-alt1118.0.2-alt0.p10.1ALT-PU-2020-1110-1244791Fixed
firefoxp972.0.2-alt0.1.p9105.0.1-alt0.c9.1ALT-PU-2020-1617-1245893Fixed
firefoxc10f172.0.2-alt1112.0.2-alt0.p10.1ALT-PU-2020-1110-1244791Fixed
firefoxc9f272.0.2-alt0.1.p9105.0.1-alt0.c9.1ALT-PU-2020-1617-1245893Fixed
firefox-esrsisyphus78.0.2-alt1115.10.0-alt1ALT-PU-2020-2408-1255107Fixed
firefox-esrp1078.0.2-alt1115.10.0-alt1ALT-PU-2020-2408-1255107Fixed
firefox-esrp978.3.0-alt0.1.p9102.11.0-alt0.c9.1ALT-PU-2020-2933-1254920Fixed
firefox-esrc10f178.0.2-alt1115.9.1-alt0.c10.1ALT-PU-2020-2408-1255107Fixed
firefox-esrc9f278.7.1-alt0.1.c9102.12.0-alt0.c9.1ALT-PU-2021-1368-1264611Fixed
nsssisyphus3.49.1-alt13.99-alt1ALT-PU-2020-1109-1244791Fixed
nssp103.49.1-alt13.93.0-alt1ALT-PU-2020-1109-1244791Fixed
nssp93.51.0-alt13.86-alt1ALT-PU-2020-1616-1245893Fixed
nssc10f13.49.1-alt13.92.0-alt1ALT-PU-2020-1109-1244791Fixed
nssc9f23.51.0-alt13.98-alt1ALT-PU-2020-1616-1245893Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1590001
  • Issue Tracking
  • Permissions Required
https://www.mozilla.org/security/advisories/mfsa2020-01/
  • Vendor Advisory
USN-4234-1
  • Third Party Advisory
USN-4397-1
  • Third Party Advisory
DSA-4726
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      72.0

      Configuration 2

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

      Configuration 3

      cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.0
Back to top