PT-2018-1955 · Mozilla+5 · Network Security Services+5

Mt · Published 2018-08-14 · Updated 2024-06-15 · CVE-2018-12384

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Network Security Services (NSS) versions prior to 3.39

Description The issue is related to errors in generating values when handling SSLv2-compatible ClientHello requests, allowing for the full malleability of the ClientHello for SSLv2 used for TLS 1.2. This can enable a remote attacker to gain unauthorized access to protected information, potentially compromising the confidentiality and integrity of the data. The vulnerability does not impact TLS 1.3.

Recommendations For versions prior to 3.39, update to version 3.39 or later to resolve the issue. As a temporary workaround, consider restricting the use of SSLv2-compatible ClientHello requests until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-300

CWE-254

CWE-200

CWE-335

Related Identifiers

ALT-PU-2018-2296

BDU:2018-01562

BDU:2019-01764

BDU:2019-04362

CESA-2018_2768

CESA-2018_2898

CVE-2018-12384

MGASA-2018-0393

OPENSUSE-SU-2018_4117-1

OPENSUSE-SU-2024:11058-1

RHSA-2018:2768

RHSA-2018:2898

RHSA-2018_2768

RHSA-2018_2898

SUSE-SU-2018:4235-1

SUSE-SU-2018:4236-1

SUSE-SU-2018:4236-2

USN-3850-1

USN-3850-2

Affected Products

Alt Linux

Centos

Network Security Services

Red Hat

Suse

Ubuntu

References · 62

• https://osv.dev/vulnerability/ALPINE-CVE-2018-12384 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01562 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11058-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0393 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04362 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12384 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12384 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-12384 · Security Note
• https://advisories.mageia.org/MGASA-2018-0393.html · Security Note
• https://ubuntu.com/security/CVE-2018-0495 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:4236-2 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:4236-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12384 · Vendor Advisory