Vulnerability Description
A denial of service vulnerability exists in the Windows implementation of Transport Layer Security (TLS) when it improperly handles certain key exchanges. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. To exploit this vulnerability, a remote unauthenticated attacker could send a specially crafted request to a target system utilizing TLS 1.2 or lower, triggering the system to automatically reboot. The update addresses the vulnerability by changing the way TLS key exchange messages are validated.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 10 | 1709 |
| Microsoft | Windows Server 2019 | - |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-1118
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1118PatchVendor Advisory
FAQ
What is CVE-2020-1118?
CVE-2020-1118 is a vulnerability with a CVSS score of 8.6 (HIGH). A denial of service vulnerability exists in the Windows implementation of Transport Layer Security (TLS) when it improperly handles certain key exchanges. An attacker who successfully exploited the vu...
How severe is CVE-2020-1118?
CVE-2020-1118 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-1118?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Windows 10, Microsoft Windows Server 2019.