CVE-2018-12404 Weak cryptography in Network Security Services (NSS)
A side-channel attack in NSS RSA handshakes allows attackers to decrypt encrypted content via a Bleichenbacher variant.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-12404?
CVE-2018-12404 is a medium-severity vulnerability in Mozilla Network Security Services, published on 2 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.
Which versions are affected by CVE-2018-12404?
It affects 1 product.
Linux distribution packages (1)
mozilla-nss openSUSE:Leap 15.0 | All versions | 3.41.1-lp150.2.16.1 |
Products include Mozilla Network Security Services.
How do I fix CVE-2018-12404?
Upgrade to a fixed version.
Is CVE-2018-12404 being exploited?
There is no known exploitation of CVE-2018-12404 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Network Security Services
Sources
Also known as ALPINE-CVE-2018-12404, DEBIAN-CVE-2018-12404, GHSA-54r4-cg3v-pxw7, MGASA-2018-0482, UBUNTU-CVE-2018-12404, openSUSE-SU-2019:0183-1.