CVE-2018-12384: Medium severity IBM Cognos Analytics vulnerability
A flaw was found with NSS library when compiled with a server application. A man-in-the-middle attacker could use this flaw in a passive replay attack.
The most severe issue for confidentiality is for stream ciphers (and AES-GCM), as the server may encrypt different data with the exact same key stream and idempotency, the server may perform same action multiple times without proper authentication
Other sources
Mozilla Network Security Services (NSS), as used in Mozilla Firefox, could allow a remote attacker to obtain sensitive information, caused by the improper handling of an SSLv2-compatible ClientHello message. By conducting a passive replay attack, an attacker could exploit this vulnerability to obtain sensitive information.
— IBM
When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-12384?
CVE-2018-12384 is a vulnerability that affects the handling of SSLv2-compatible ClientHello requests in the NSS library, resulting in full malleability of the ClientHello for SSLv2 used for TLS 1.2.
How severe is CVE-2018-12384?
CVE-2018-12384 has a severity score of 5.9, which is considered medium.
Which software versions are affected by CVE-2018-12384?
NSS versions prior to 3.39 are affected by CVE-2018-12384.
How can I fix CVE-2018-12384?
To fix CVE-2018-12384, update the NSS library to version 3.39 or higher.
Where can I find more information about CVE-2018-12384?
You can find more information about CVE-2018-12384 in the references provided: Bugzilla Mozilla, Oracle Security Advisory, and Launchpad Bugs.