CVE-2022-20960
First published: Thu Nov 03 2022(Updated: )
A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain TLS connections that are processed by an affected device. An attacker could exploit this vulnerability by establishing a large number of concurrent TLS connections to an affected device. A successful exploit could allow the attacker to cause the device to drop new TLS email messages that come from the associated email servers. Exploitation of this vulnerability does not cause the affected device to unexpectedly reload. The device will recover autonomously within a few hours of when the attack is halted or mitigated.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Email Security Appliance | <14.2.1-015 | |
| Cisco Email Security Appliance | >=14.3.0<14.3.0-020 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-20960.
What is the severity of CVE-2022-20960?
The severity of CVE-2022-20960 is high with a CVSS score of 7.5.
Which software is affected by CVE-2022-20960?
Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) versions 14.2.1-015 and 14.3.0-020 are affected by this vulnerability.
What is the impact of CVE-2022-20960?
CVE-2022-20960 can allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on the affected device.
Is there a fix available for CVE-2022-20960?
Cisco has released software updates to address this vulnerability. Please refer to the Cisco Security Advisory for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco email security appliance
- version/cisco email security appliance/14.3.0