{"id":"CVE-2018-12384","aliases":["ALPINE-CVE-2018-12384","BELL-CVE-2018-12384","DEBIAN-CVE-2018-12384","EUVD-2018-4358","GHSA-rg3c-6wcj-37gm","MGASA-2018-0393","RHSA-2018:2768","RHSA-2018:2898","SUSE-SU-2018:4235-1","SUSE-SU-2018:4236-1","SUSE-SU-2018:4236-2","UBUNTU-CVE-2018-12384","USN-3850-1","openSUSE-SU-2024:11058-1"],"status":"published","title":"When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random...","description":"When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01484,"percentile":0.74166,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-335"],"published":"2018-09-04T00:00:00Z","modified":"2026-10-23T18:03:36Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"nss","fixed_in":["3.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"nss","fixed_in":["3.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nss","fixed_in":["3.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nss","fixed_in":["3.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nss","fixed_in":["3.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nss","fixed_in":["3.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nss","fixed_in":["3.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nss","fixed_in":["3.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nss","fixed_in":["3.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"nss","fixed_in":["3.36.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"nss","fixed_in":["3.39-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nss","fixed_in":["2:3.39-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nss","fixed_in":["2:3.39-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nss","fixed_in":["2:3.39-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"firefox","fixed_in":["60.2.1-1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"firefox-l10n","fixed_in":["60.2.1-1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"nss","fixed_in":["3.36.5-1.1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"sqlite3","fixed_in":["3.22.0-2.1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"hunspell1.6","fixed_in":["1.6.2-1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-debuginfo","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-sysinit","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-tools","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-devel","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-pkcs11-devel","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-debuginfo","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-sysinit","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-tools","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-devel","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-pkcs11-devel","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-debuginfo","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-devel","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-sysinit","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-tools","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-pkcs11-devel","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-debuginfo","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-devel","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-sysinit","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-tools","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-pkcs11-devel","fixed_in":["0:3.36.0-7.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-debuginfo","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-sysinit","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-tools","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-devel","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-pkcs11-devel","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-debuginfo","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-sysinit","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-tools","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-devel","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-pkcs11-devel","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-debuginfo","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-devel","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-sysinit","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-tools","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-pkcs11-devel","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-debuginfo","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-devel","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-sysinit","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-tools","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-pkcs11-devel","fixed_in":["0:3.36.0-9.el6_10"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"nss","fixed_in":["2:3.28.4-0ubuntu0.14.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"nss","fixed_in":["2:3.28.4-0ubuntu0.16.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"nss","fixed_in":["2:3.35-2ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.39-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.39-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.39-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.39-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.2.1-1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.2.1-1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.5-1.1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-2.1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"hunspell1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-7.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.36.0-9.el6_10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-3.3.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-3.7.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0-3.21.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.4-0ubuntu0.14.04.4"}]}],"versions":["2:3.15.1-1ubuntu1","2:3.15.2-1","2:3.15.3-1","2:3.15.3.1-1","2:3.15.3.1-1.1","2:3.15.3.1-1.1ubuntu1","2:3.15.4-1ubuntu3","2:3.15.4-1ubuntu4","2:3.15.4-1ubuntu5","2:3.15.4-1ubuntu6","2:3.15.4-1ubuntu7","2:3.15.4-1ubuntu7.1","2:3.17-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.2","2:3.17.4-0ubuntu0.14.04.1","2:3.19.2-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.2","2:3.21-0ubuntu0.14.04.1","2:3.21-0ubuntu0.14.04.2","2:3.23-0ubuntu0.14.04.1","2:3.26.2-0ubuntu0.14.04.3","2:3.28.4-0ubuntu0.14.04.1","2:3.28.4-0ubuntu0.14.04.2","2:3.28.4-0ubuntu0.14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.4-0ubuntu0.16.04.4"}]}],"versions":["2:3.19.2-1ubuntu1","2:3.19.2.1-0ubuntu1","2:3.21-1ubuntu2","2:3.21-1ubuntu3","2:3.21-1ubuntu4","2:3.23-0ubuntu0.16.04.1","2:3.26.2-0ubuntu0.16.04.2","2:3.28.4-0ubuntu0.16.04.1","2:3.28.4-0ubuntu0.16.04.2","2:3.28.4-0ubuntu0.16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.35-2ubuntu2.1"}]}],"versions":["2:3.32-1ubuntu3","2:3.34-1ubuntu1","2:3.35-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.4-0ubuntu0.14.04.4"}]}],"versions":["2:3.15.1-1ubuntu1","2:3.15.2-1","2:3.15.3-1","2:3.15.3.1-1","2:3.15.3.1-1.1","2:3.15.3.1-1.1ubuntu1","2:3.15.4-1ubuntu3","2:3.15.4-1ubuntu4","2:3.15.4-1ubuntu5","2:3.15.4-1ubuntu6","2:3.15.4-1ubuntu7","2:3.15.4-1ubuntu7.1","2:3.17-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.2","2:3.17.4-0ubuntu0.14.04.1","2:3.19.2-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.2","2:3.21-0ubuntu0.14.04.1","2:3.21-0ubuntu0.14.04.2","2:3.23-0ubuntu0.14.04.1","2:3.26.2-0ubuntu0.14.04.3","2:3.28.4-0ubuntu0.14.04.1","2:3.28.4-0ubuntu0.14.04.2","2:3.28.4-0ubuntu0.14.04.3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.4-0ubuntu0.16.04.4"}]}],"versions":["2:3.19.2-1ubuntu1","2:3.19.2.1-0ubuntu1","2:3.21-1ubuntu2","2:3.21-1ubuntu3","2:3.21-1ubuntu4","2:3.23-0ubuntu0.16.04.1","2:3.26.2-0ubuntu0.16.04.2","2:3.28.4-0ubuntu0.16.04.1","2:3.28.4-0ubuntu0.16.04.2","2:3.28.4-0ubuntu0.16.04.3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.35-2ubuntu2.1"}]}],"versions":["2:3.32-1ubuntu3","2:3.34-1ubuntu1","2:3.35-2ubuntu2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.69.1-1.2"}]}],"bundled":14}],"products":[{"vendor":"mozilla","product":"network security services (nss)"},{"vendor":"mozilla","product":"network_security_services"},{"vendor":"nss","product":"network security services (nss)"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12384","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12384","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rg3c-6wcj-37gm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-12384","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-12384","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-12384","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0393.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23511","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2768","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1622089","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2768.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12384","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12384","tags":["advisory","report"]},{"url":"https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.5_release_notes","tags":["article","report"]},{"url":"https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.39_release_notes","tags":["article","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2898","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2898.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184235-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1097410","tags":["report"]},{"url":"https://bugzilla.suse.com/1106873","tags":["report"]},{"url":"https://bugzilla.suse.com/1119069","tags":["report"]},{"url":"https://bugzilla.suse.com/1119105","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18498","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184236-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184236-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-12384","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3850-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3850-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-0495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12404","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6829","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-12384","description":"When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.","status":"published","published":"2019-04-29T14:22:53Z","modified":"2024-08-05T08:31:00.061Z","updated_at":"2026-11-02T14:35:06.320867Z"}],"euvd":[{"id":"EUVD-2018-4358","description":"When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.","status":"published","published":"2019-04-29T14:22:53Z","modified":"2024-08-05T08:31:00Z","updated_at":"2026-11-03T02:39:52.61924Z"}],"ghsa":[{"id":"GHSA-rg3c-6wcj-37gm","title":"When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random...","description":"When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.","status":"published","published":"2022-05-24T16:44:49Z","modified":"2024-04-04T00:15:46Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-335"],"updated_at":"2026-11-02T14:55:49.472376Z"}],"nvd":[{"id":"CVE-2018-12384","description":"When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.","status":"published","published":"2019-04-29T15:29:00.247Z","modified":"2026-06-17T01:37:40.543Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-335"],"updated_at":"2026-11-02T14:04:57.307075Z"}],"osv":[{"id":"ALPINE-CVE-2018-12384","description":"When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.","status":"published","published":"2019-04-29T15:29:00.247Z","modified":"2026-10-23T17:17:55.20864018Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2018-12384","title":"CVE-2018-12384 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:17.291042Z","modified":"2026-01-26T09:48:58.813336Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-12384","description":"When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.","status":"published","published":"2019-04-29T15:29:00.247Z","modified":"2026-04-16T06:16:42.248068802Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-12384","description":"When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.","status":"published","published":"2019-04-29T15:29:00.247Z","modified":"2026-10-23T18:03:36.198735918Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"RHSA-2018:2768","title":"Red Hat Security Advisory: nss security update","status":"published","published":"2024-09-16T01:45:52Z","modified":"2026-06-26T12:21:05.88855032Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:2898","title":"Red Hat Security Advisory: nss security update","status":"published","published":"2024-09-16T01:45:46Z","modified":"2026-06-26T12:21:55.828729288Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-12384","description":"When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.","status":"published","published":"2018-09-04T00:00:00Z","modified":"2026-04-22T11:43:52.298815Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"MGASA-2018-0393","title":"Updated firefox packages fix security vulnerability","description":"Firefox 60 is now the only supported version of the ESR series and it\nbrings a completely new browser engine, designed to take full advantage of\nthe processing power in modern devices. Firefox also now exclusively\nsupports extensions built using the WebExtension API.\n\nThis update brings Firefox 60.2.1 along with the needed updated libraries :\n- NSS 3.36.5 (fixes CVE CVE-2018-12384)\n- Sqlite 3.22.0\n- Hunspell 1.6.2\n","status":"published","published":"2018-10-01T08:44:39Z","modified":"2026-04-16T06:24:11.496799107Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11058-1","title":"libfreebl3-3.69.1-1.2 on GA media","description":"These are all security issues fixed in the libfreebl3-3.69.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:19:08.673425Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:4235-1","title":"Security update for MozillaFirefox, mozilla-nspr and mozilla-nss","description":"This update for MozillaFirefox, mozilla-nss and mozilla-nspr fixes the following issues:\n\nIssues fixed in MozillaFirefox:\n\n- Update to Firefox ESR 60.4 (bsc#1119105)\n- CVE-2018-17466: Fixed a buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11\n- CVE-2018-18492: Fixed a use-after-free with select element\n- CVE-2018-18493: Fixed a buffer overflow in accelerated 2D canvas with Skia\n- CVE-2018-18494: Fixed a Same-origin policy violation using location attribute and performance.getEntries\n  to steal cross-origin URLs\n- CVE-2018-18498: Fixed a integer overflow when calculating buffer sizes for images\n- CVE-2018-12405: Fixed a few memory safety bugs\n\nIssues fixed in mozilla-nss:\n\n- Update to NSS 3.40.1 (bsc#1119105)\n- CVE-2018-12404: Fixed a cache side-channel variant of the Bleichenbacher attack (bsc#1119069)\n- CVE-2018-12384: Fixed an issue in the SSL handshake. NSS responded to an\n  SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. (bsc#1106873)\n- CVE-2018-0495: Fixed a memory-cache side-channel attack with ECDSA signatures (bsc#1097410)\n- Fixed a decryption failure during FFDHE key exchange\n- Various security fixes in the ASN.1 code\n\nIssues fixed in mozilla-nspr:\n\n- Update mozilla-nspr to 4.20 (bsc#1119105)\n","status":"published","published":"2018-12-21T17:47:33Z","modified":"2026-02-04T04:35:50.433821Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2018:4236-1","title":"Security update for MozillaFirefox, mozilla-nspr and mozilla-nss","description":"This update for MozillaFirefox, mozilla-nss and mozilla-nspr fixes the following issues:\n\nIssues fixed in MozillaFirefox:\n\n- Update to Firefox ESR 60.4 (bsc#1119105)\n- CVE-2018-17466: Fixed a buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11\n- CVE-2018-18492: Fixed a use-after-free with select element\n- CVE-2018-18493: Fixed a buffer overflow in accelerated 2D canvas with Skia\n- CVE-2018-18494: Fixed a Same-origin policy violation using location attribute and performance.getEntries\n  to steal cross-origin URLs\n- CVE-2018-18498: Fixed a integer overflow when calculating buffer sizes for images\n- CVE-2018-12405: Fixed a few memory safety bugs\n\nIssues fixed in mozilla-nss:\n\n- Update to NSS 3.40.1 (bsc#1119105)\n- CVE-2018-12404: Fixed a cache side-channel variant of the Bleichenbacher attack (bsc#1119069)\n- CVE-2018-12384: Fixed an issue in the SSL handshake. NSS responded to an\n  SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. (bsc#1106873)\n- CVE-2018-0495: Fixed a memory-cache side-channel attack with ECDSA signatures (bsc#1097410)\n- Fixed a decryption failure during FFDHE key exchange\n- Various security fixes in the ASN.1 code\n\nIssues fixed in mozilla-nspr:\n\n- Update mozilla-nspr to 4.20 (bsc#1119105)\n","status":"published","published":"2018-12-21T17:49:53Z","modified":"2026-02-04T03:42:47.45532Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2018:4236-2","title":"Security update for MozillaFirefox, mozilla-nspr and mozilla-nss","description":"This update for MozillaFirefox, mozilla-nss and mozilla-nspr fixes the following issues:\n\nIssues fixed in MozillaFirefox:\n\n- Update to Firefox ESR 60.4 (bsc#1119105)\n- CVE-2018-17466: Fixed a buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11\n- CVE-2018-18492: Fixed a use-after-free with select element\n- CVE-2018-18493: Fixed a buffer overflow in accelerated 2D canvas with Skia\n- CVE-2018-18494: Fixed a Same-origin policy violation using location attribute and performance.getEntries\n  to steal cross-origin URLs\n- CVE-2018-18498: Fixed a integer overflow when calculating buffer sizes for images\n- CVE-2018-12405: Fixed a few memory safety bugs\n\nIssues fixed in mozilla-nss:\n\n- Update to NSS 3.40.1 (bsc#1119105)\n- CVE-2018-12404: Fixed a cache side-channel variant of the Bleichenbacher attack (bsc#1119069)\n- CVE-2018-12384: Fixed an issue in the SSL handshake. NSS responded to an\n  SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. (bsc#1106873)\n- CVE-2018-0495: Fixed a memory-cache side-channel attack with ECDSA signatures (bsc#1097410)\n- Fixed a decryption failure during FFDHE key exchange\n- Various security fixes in the ASN.1 code\n\nIssues fixed in mozilla-nspr:\n\n- Update mozilla-nspr to 4.20 (bsc#1119105)\n","status":"published","published":"2019-04-15T15:37:00Z","modified":"2026-02-04T03:20:23.659661Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3850-1","title":"nss vulnerabilities","description":"Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation.\nA local attacker could possibly use this issue to perform a cache-timing\nattack and recover private ECDSA keys. (CVE-2018-0495)\n\nIt was discovered that NSS incorrectly handled certain v2-compatible\nClientHello messages. A remote attacker could possibly use this issue to\nperform a replay attack. (CVE-2018-12384)\n\nIt was discovered that NSS incorrectly handled certain padding oracles. A\nremote attacker could possibly use this issue to perform a variant of the\nBleichenbacher attack. (CVE-2018-12404)\n","status":"published","published":"2019-01-09T17:41:27Z","modified":"2026-04-22T09:52:38.331565Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}