p PatchFirst

CVE-2018-12384

CVE-2018-12384

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.

CVSS 5.9 · Medium · EPSS 1.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • network security services (nss)

    Versions
    • All versions prior to NSS 3.39: Affected

    No fix published

  • nss Debian:12

    Affected ranges
    • ECOSYSTEM: < 2:3.39-1

    Update to 2:3.39-1

  • nss Debian:13

    Affected ranges
    • ECOSYSTEM: < 2:3.39-1

    Update to 2:3.39-1

  • nss Debian:14

    Affected ranges
    • ECOSYSTEM: < 2:3.39-1

    Update to 2:3.39-1

  • nss Ubuntu:14.04:LTS

    Versions
    • 2:3.15.1-1ubuntu1
    • 2:3.15.2-1
    • 2:3.15.3-1
    • 2:3.15.3.1-1
    • 2:3.15.3.1-1.1
    • 2:3.15.3.1-1.1ubuntu1
    • 2:3.15.4-1ubuntu3
    • 2:3.15.4-1ubuntu4
    • 2:3.15.4-1ubuntu5
    • 2:3.15.4-1ubuntu6
    • 2:3.15.4-1ubuntu7
    • 2:3.15.4-1ubuntu7.1
    • 2:3.17-0ubuntu0.14.04.1
    • 2:3.17.1-0ubuntu0.14.04.1
    • 2:3.17.1-0ubuntu0.14.04.2
    • 2:3.17.4-0ubuntu0.14.04.1
    • 2:3.19.2-0ubuntu0.14.04.1
    • 2:3.19.2.1-0ubuntu0.14.04.1
    • 2:3.19.2.1-0ubuntu0.14.04.2
    • 2:3.21-0ubuntu0.14.04.1
    • 2:3.21-0ubuntu0.14.04.2
    • 2:3.23-0ubuntu0.14.04.1
    • 2:3.26.2-0ubuntu0.14.04.3
    • 2:3.28.4-0ubuntu0.14.04.1
    • 2:3.28.4-0ubuntu0.14.04.2
    • 2:3.28.4-0ubuntu0.14.04.3
    Affected ranges
    • ECOSYSTEM: < 2:3.28.4-0ubuntu0.14.04.4

    Update to 2:3.28.4-0ubuntu0.14.04.4

  • nss Ubuntu:16.04:LTS

    Versions
    • 2:3.19.2-1ubuntu1
    • 2:3.19.2.1-0ubuntu1
    • 2:3.21-1ubuntu2
    • 2:3.21-1ubuntu3
    • 2:3.21-1ubuntu4
    • 2:3.23-0ubuntu0.16.04.1
    • 2:3.26.2-0ubuntu0.16.04.2
    • 2:3.28.4-0ubuntu0.16.04.1
    • 2:3.28.4-0ubuntu0.16.04.2
    • 2:3.28.4-0ubuntu0.16.04.3
    Affected ranges
    • ECOSYSTEM: < 2:3.28.4-0ubuntu0.16.04.4

    Update to 2:3.28.4-0ubuntu0.16.04.4

  • nss Ubuntu:18.04:LTS

    Versions
    • 2:3.32-1ubuntu3
    • 2:3.34-1ubuntu1
    • 2:3.35-2ubuntu2
    Affected ranges
    • ECOSYSTEM: < 2:3.35-2ubuntu2.1

    Update to 2:3.35-2ubuntu2.1

Original sources

Check your server →