PT-2018-2488 · Mozilla+5 · Network Security Services+5
Eyal Ronen
·
Publicado
2018-08-23
·
Atualizado
2024-06-15
·
CVE-2018-12404
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Network Security Services (NSS) versions prior to 3.41
Description
A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This issue is related to errors in cryptographic transformations and can be exploited to gain unauthorized access to protected information. The attack is a variant of the Adaptive Chosen Ciphertext attack, also known as the Bleichenbacher attack. It may also involve downgrading the used TLS protocol version, allowing an attacker to access protected information using a side channel.
Recommendations
For NSS versions prior to 3.41, update to version 3.41 or later to resolve the issue.
As a temporary workaround, consider restricting the use of RSA encryption for handshakes until a patch is available.
Restrict access to sensitive information to minimize the risk of exploitation.
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Network Security Services
Red Hat
Suse
Ubuntu