K28409184 : Mozilla NSS vulnerability CVE-2020-12413

Security Advisory Description

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites. (CVE-2020-12413)

Impact

This can lead to an attacker being able to compute the pre-master secret in connections that have used a Diffie-Hellman (DH)-based cipher suite. In such a case, this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The highest threat from this vulnerability is to data confidentiality.