Description
After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | Firefox | before 72 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nss | 2:3.49-1 | — |
| Debian 13 | nss | 2:3.49-1 | — |
| Debian 12 | nss | 2:3.49-1 | — |
| Debian 10 | nss | 2:3.42.1-1+deb10u3 | DSA-4726-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | firefox | 72.0.1+build1-0ubuntu1 | — |
| Ubuntu 20.04 LTS | nss | 2:3.49.1-1ubuntu1.1 | USN-4397-1 |
| Ubuntu 18.04 LTS | firefox | 72.0.1+build1-0ubuntu0.18.04.1 | USN-4234-1 |
| Ubuntu 18.04 LTS | nss | 2:3.35-2ubuntu2.8 | USN-4397-1 |
| Ubuntu 16.04 LTS | firefox | 72.0.1+build1-0ubuntu0.16.04.1 | USN-4234-1 |
| Ubuntu 16.04 LTS | nss | 2:3.28.4-0ubuntu0.16.04.11 | USN-4397-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nspr +1 | 4.25.0-2.el8_2 | RHSA-2020:3280 |
| RHEL 8 | nss +9 | 3.53.1-11.el8_2 | RHSA-2020:3280 |
| RHEL 7 | nspr +1 | 4.25.0-2.el7_9 | RHSA-2020:4076 |
| RHEL 7 | nss +4 | 3.53.1-3.el7_9 | RHSA-2020:4076 |
| RHEL 7 | nss-softokn +3 | 3.53.1-6.el7_9 | RHSA-2020:4076 |
| RHEL 7 | nss-util +1 | 3.53.1-1.el7_9 | RHSA-2020:4076 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nspr | 4.25.0-2.el8_2 | RLSA-2020:3280 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 92.0-1.2 | openSUSE-SU-2024:10600-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | librewolf | 71.0.1-r0 | — |
| Alpine v3.24 | nss | 3.49-r0 | — |
| Alpine v3.23 | firefox +1 | 71.0.1-r0 | — |
| Alpine v3.23 | nss | 3.49-r0 | — |
| Alpine v3.22 | firefox +1 | 71.0.1-r0 | — |
| Alpine v3.22 | nss | 3.49-r0 | — |
| Alpine v3.21 | firefox +1 | 71.0.1-r0 | — |
| Alpine v3.21 | nss | 3.49-r0 | — |
| Alpine v3.20 | firefox | 71.0.1-r0 | — |
| Alpine v3.20 | nss | 3.49-r0 | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | firefox | 71.0.1-r0 | — |
| Alpine v3.19 | nss | 3.49-r0 | — |
| Alpine v3.18 | firefox | 71.0.1-r0 | — |
| Alpine v3.18 | nss | 3.49-r0 | — |
| Alpine v3.17 | firefox | 71.0.1-r0 | — |
| Alpine v3.17 | nss | 3.49-r0 | — |
| Alpine v3.16 | firefox | 71.0.1-r0 | — |
| Alpine v3.16 | nss | 3.49-r0 | — |
| Alpine v3.15 | firefox | 71.0.1-r0 | — |
| Alpine v3.15 | nss | 3.49-r0 | — |
| Alpine v3.14 | firefox | 71.0.1-r0 | — |
| Alpine v3.14 | nss | 3.49-r0 | — |
| Alpine v3.13 | firefox | 71.0.1-r0 | — |
| Alpine v3.13 | nss | 3.49-r0 | — |
| Alpine v3.12 | firefox | 71.0.1-r0 | — |
| Alpine v3.12 | nss | 3.49-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | nspr +1 | 4.25.0-2.amzn2 | ALAS2-2020-1559 |
| Amazon Linux 2 | nss +4 | 3.53.1-3.amzn2 | ALAS2-2020-1559 |
| Amazon Linux 2 | nss-softokn +3 | 3.53.1-6.amzn2 | ALAS2-2020-1559 |
| Amazon Linux 2 | nss-util +1 | 3.53.1-1.amzn2 | ALAS2-2020-1559 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | nspr +1 | 4.25.0-2.el8_2 | ELSA-2020-3280 |
| Oracle Linux 8 | nss +9 | 3.53.1-11.el8_2 | ELSA-2020-3280 |
| Oracle Linux 7 | nspr +1 | 4.25.0-2.el7_9 | ELSA-2020-4076 |
| Oracle Linux 7 | nss +4 | 3.53.1-3.el7_9 | ELSA-2020-4076 |
| Oracle Linux 7 | nss-softokn +3 | 3.53.1-6.0.1.el7_9 | ELSA-2020-4076 |
| Oracle Linux 7 | nss-util +1 | 3.53.1-1.el7_9 | ELSA-2020-4076 |
Advisories 12
- RHSA-2020:4076 Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2020:3280 Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- USN-4397-1 nss vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-4234-1 firefox vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-4726-1 nss - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2020:3280 Moderate: nss and nspr security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2024:10600-1 MozillaFirefox-92.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
- ALAS2-2020-1559 Moderate: nspr security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 11, 2020
- ELSA-2020-4076 Moderate: nss and nspr security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 8, 2020
- ELSA-2020-3280 Moderate: nss and nspr security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 4, 2020
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1590001
- https://www.mozilla.org/security/advisories/mfsa2020-01/
- USN-4234-1 vendor-advisory
- USN-4397-1 vendor-advisory
- DSA-4726 vendor-advisory