CVE-2019-17023

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State…

published January 8, 2020

CVSS
—
EPSS
1%
Percentile
70.9
In the wild
Unconfirmed
What it is

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01340 · 70.9th percentile
Published
2020-01-08T21:30Z
EPSS history
Timeline
  • 08 JAN 21:30Z
    After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State…
    cvelistv5