CVEvulnerability
CVE-2018-12384
5.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-04-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-335
Description
When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
Affected configurations
• mozilla network security services (< 3.39)
Related
Weakness · CWE (1)
- CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12384 Issue Tracking, Vendor Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html www.oracle.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12384 Issue Tracking, Vendor Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html www.oracle.com