{"id":"CVE-2018-12404","aliases":["ALPINE-CVE-2018-12404","BELL-CVE-2018-12404","DEBIAN-CVE-2018-12404","DLA-1704-1","DLA-2388-1","EUVD-2018-4378","GHSA-54r4-cg3v-pxw7","MGASA-2018-0482","RHSA-2019:2237","SUSE-SU-2018:4235-1","SUSE-SU-2018:4236-1","SUSE-SU-2018:4236-2","SUSE-SU-2019:0273-1","UBUNTU-CVE-2018-12404","USN-3850-1","openSUSE-SU-2019:0183-1","openSUSE-SU-2019:1758-1","openSUSE-SU-2024:11058-1"],"status":"published","title":"A cached side channel attack during handshakes using RSA encryption could allow for the...","description":"A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.44248,"percentile":0.98765,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-12-12T00:00:00Z","modified":"2026-10-23T18:03:53Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"nss","fixed_in":["3.41-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"nss","fixed_in":["3.41-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nss","fixed_in":["3.41-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nss","fixed_in":["3.41-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nss","fixed_in":["3.41-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nss","fixed_in":["3.41-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nss","fixed_in":["3.41-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nss","fixed_in":["3.41-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nss","fixed_in":["3.41-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"nss","fixed_in":["3.41-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nss","fixed_in":["2:3.41-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nss","fixed_in":["2:3.41-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nss","fixed_in":["2:3.41-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"nss","fixed_in":["3.36.6-1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"rootcerts","fixed_in":["20181108.00-1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"nss","fixed_in":["2:3.28.4-0ubuntu0.14.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"nss","fixed_in":["2:3.28.4-0ubuntu0.16.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"nss","fixed_in":["2:3.35-2ubuntu2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"mozilla-nss","fixed_in":["3.41.1-lp150.2.16.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.41-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.41-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.41-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.26-1+debu8u4"}]}],"versions":["2:3.17.2-1.1","2:3.17.2-1.1+deb8u1","2:3.17.2-1.1+deb8u2","2:3.17.2-1.1+x32","2:3.17.4-1","2:3.18-1","2:3.19-1","2:3.19.1-1","2:3.19.1-2","2:3.19.2-1","2:3.19.2-1+x32.1","2:3.20-1","2:3.20.1-1","2:3.21-1","2:3.21-1.1","2:3.23-1","2:3.23-2","2:3.25-1","2:3.26-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.26.2-1.1+deb9u2"}]}],"versions":["2:3.26.2-1.1","2:3.26.2-1.1+deb9u1"],"bundled":13},{"source":"osv","ecosystem":"Mageia:6","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.6-1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"rootcerts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20181108.00-1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.21.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nspr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.21.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-softokn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-softokn-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-softokn-freebl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nspr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.21.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-softokn-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-softokn-freebl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.21.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nspr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.21.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-softokn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-softokn-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-softokn-freebl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nspr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.21.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-softokn-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-softokn-freebl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.21.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nspr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.21.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nspr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.21.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-softokn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-softokn-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-softokn-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-softokn-freebl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-softokn-freebl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.21.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nspr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.21.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nspr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.21.0-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-softokn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-softokn-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-softokn-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-softokn-freebl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-softokn-freebl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-3.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.44.0-4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-3.3.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-3.7.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0-3.21.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.4.0esr-109.55.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20-19.6.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.1-58.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41.1-3.13.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.5.0-3.24.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.4-0ubuntu0.14.04.4"}]}],"versions":["2:3.15.1-1ubuntu1","2:3.15.2-1","2:3.15.3-1","2:3.15.3.1-1","2:3.15.3.1-1.1","2:3.15.3.1-1.1ubuntu1","2:3.15.4-1ubuntu3","2:3.15.4-1ubuntu4","2:3.15.4-1ubuntu5","2:3.15.4-1ubuntu6","2:3.15.4-1ubuntu7","2:3.15.4-1ubuntu7.1","2:3.17-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.2","2:3.17.4-0ubuntu0.14.04.1","2:3.19.2-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.2","2:3.21-0ubuntu0.14.04.1","2:3.21-0ubuntu0.14.04.2","2:3.23-0ubuntu0.14.04.1","2:3.26.2-0ubuntu0.14.04.3","2:3.28.4-0ubuntu0.14.04.1","2:3.28.4-0ubuntu0.14.04.2","2:3.28.4-0ubuntu0.14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.4-0ubuntu0.16.04.4"}]}],"versions":["2:3.19.2-1ubuntu1","2:3.19.2.1-0ubuntu1","2:3.21-1ubuntu2","2:3.21-1ubuntu3","2:3.21-1ubuntu4","2:3.23-0ubuntu0.16.04.1","2:3.26.2-0ubuntu0.16.04.2","2:3.28.4-0ubuntu0.16.04.1","2:3.28.4-0ubuntu0.16.04.2","2:3.28.4-0ubuntu0.16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.35-2ubuntu2.1"}]}],"versions":["2:3.32-1ubuntu3","2:3.34-1ubuntu1","2:3.35-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.4-0ubuntu0.14.04.4"}]}],"versions":["2:3.15.1-1ubuntu1","2:3.15.2-1","2:3.15.3-1","2:3.15.3.1-1","2:3.15.3.1-1.1","2:3.15.3.1-1.1ubuntu1","2:3.15.4-1ubuntu3","2:3.15.4-1ubuntu4","2:3.15.4-1ubuntu5","2:3.15.4-1ubuntu6","2:3.15.4-1ubuntu7","2:3.15.4-1ubuntu7.1","2:3.17-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.2","2:3.17.4-0ubuntu0.14.04.1","2:3.19.2-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.2","2:3.21-0ubuntu0.14.04.1","2:3.21-0ubuntu0.14.04.2","2:3.23-0ubuntu0.14.04.1","2:3.26.2-0ubuntu0.14.04.3","2:3.28.4-0ubuntu0.14.04.1","2:3.28.4-0ubuntu0.14.04.2","2:3.28.4-0ubuntu0.14.04.3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.28.4-0ubuntu0.16.04.4"}]}],"versions":["2:3.19.2-1ubuntu1","2:3.19.2.1-0ubuntu1","2:3.21-1ubuntu2","2:3.21-1ubuntu3","2:3.21-1ubuntu4","2:3.23-0ubuntu0.16.04.1","2:3.26.2-0ubuntu0.16.04.2","2:3.28.4-0ubuntu0.16.04.1","2:3.28.4-0ubuntu0.16.04.2","2:3.28.4-0ubuntu0.16.04.3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.35-2ubuntu2.1"}]}],"versions":["2:3.32-1ubuntu3","2:3.34-1ubuntu1","2:3.35-2ubuntu2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41.1-lp150.2.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.8.0-lp150.3.62.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41.1-lp150.2.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.69.1-1.2"}]}],"bundled":14}],"products":[{"vendor":"mozilla","product":"network security services (nss)"},{"vendor":"mozilla","product":"network_security_services"}],"references":[{"url":"http://www.securityfocus.com/bid/107260","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404","tags":["x_refsource_MISC","x_transferred","Issue Tracking","VDB Entry","Vendor Advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2237","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12404","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-54r4-cg3v-pxw7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-12404","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-12404","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-12404","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0482.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23972","tags":["report"]},{"url":"https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.6_release_notes","tags":["web","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1144186","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1212132","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1431241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1444136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1508571","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1508595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1509045","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1509396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1510156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1514041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1533729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1591163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1639873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1657164","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1657913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670239","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1712876","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2237.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-0495","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-0495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0495","tags":["advisory"]},{"url":"https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12404","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12404","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-17007","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17007","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184235-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1097410","tags":["report"]},{"url":"https://bugzilla.suse.com/1106873","tags":["report"]},{"url":"https://bugzilla.suse.com/1119069","tags":["report"]},{"url":"https://bugzilla.suse.com/1119105","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18498","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184236-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184236-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190273-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1120374","tags":["report"]},{"url":"https://bugzilla.suse.com/1122983","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18505","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-12404","tags":["report"]},{"url":"http://cat.eyalro.net/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3850-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3850-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-0495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12384","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/55UMHGS7YZ5AZ4K7HNYIQ73VCFF6QA4L/#55UMHGS7YZ5AZ4K7HNYIQ73VCFF6QA4L","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3XSXZIQWRQRVOR3YE3OFV7LENA3NBVZC/#3XSXZIQWRQRVOR3YE3OFV7LENA3NBVZC","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-6829","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-12404","description":"A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.","status":"published","published":"2019-05-02T16:40:14Z","modified":"2024-08-05T08:38:05.124Z","updated_at":"2026-11-02T14:35:06.679212Z"}],"euvd":[{"id":"EUVD-2018-4378","description":"A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.","status":"published","published":"2019-05-02T16:40:14Z","modified":"2024-08-05T08:38:05Z","updated_at":"2026-11-03T02:39:52.61924Z"}],"ghsa":[{"id":"GHSA-54r4-cg3v-pxw7","title":"A cached side channel attack during handshakes using RSA encryption could allow for the...","description":"A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.","status":"published","published":"2022-05-24T16:45:03Z","modified":"2024-04-04T00:25:47Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T14:55:50.017793Z"}],"nvd":[{"id":"CVE-2018-12404","description":"A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.","status":"published","published":"2019-05-02T17:29:01.677Z","modified":"2026-06-17T01:37:43.443Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:57.307075Z"}],"osv":[{"id":"ALPINE-CVE-2018-12404","description":"A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.","status":"published","published":"2019-05-02T17:29:01.677Z","modified":"2026-10-23T17:17:55.208713581Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2018-12404","title":"CVE-2018-12404 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:40.85092Z","modified":"2026-01-26T09:49:53.877621Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-12404","description":"A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.","status":"published","published":"2019-05-02T17:29:01.677Z","modified":"2026-04-16T06:21:09.883155834Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-12404","description":"A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.","status":"published","published":"2019-05-02T17:29:01.677Z","modified":"2026-10-23T18:03:53.855791442Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"RHSA-2019:2237","title":"Red Hat Security Advisory: nss, nss-softokn, nss-util, and nspr security, bug fix, and enhancement update","status":"published","published":"2024-09-16T02:16:30Z","modified":"2026-10-14T10:01:15Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2018-12404","description":"A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.","status":"published","published":"2018-12-12T00:00:00Z","modified":"2026-04-22T11:43:00.365591Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"DLA-1704-1","title":"nss - security update","status":"published","published":"2019-03-04T00:00:00Z","modified":"2026-03-09T01:22:02.140354Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2388-1","title":"nss - security update","status":"published","published":"2020-09-29T00:00:00Z","modified":"2026-03-09T01:17:51.047579Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2018-0482","title":"Updated nss packages fix security vulnerability","description":"Cache side-channel variant of the Bleichenbacher attack.(CVE-2018-12404)\n","status":"published","published":"2018-12-15T21:29:48Z","modified":"2026-04-16T06:25:29.485990152Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0183-1","title":"Security update for mozilla-nss","description":"This update for mozilla-nss fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-12404: Cache side-channel variant of the Bleichenbacher attack (bsc#1119069).\n\nNon-security issue fixed:\n\n- Update to mozilla-nss 3.41.1\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T10:59:34Z","modified":"2026-02-04T03:27:39.83216Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:1758-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox, mozilla-nss fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-18500: Fixed a use-after-free parsing HTML5 stream (bsc#1122983).\n- CVE-2018-18501: Fixed multiple memory safety bugs (bsc#1122983).\n- CVE-2018-18505: Fixed a privilege escalation through IPC channel messages (bsc#1122983).\n- CVE-2018-12404: Cache side-channel variant of the Bleichenbacher attack (bsc#1119069).\n\nNon-security issue fixed:\n\n- Update to MozillaFirefox ESR 60.5.0\n- Update to mozilla-nss 3.41.1\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-07-20T06:28:48Z","modified":"2026-02-04T04:28:27.899073Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11058-1","title":"libfreebl3-3.69.1-1.2 on GA media","description":"These are all security issues fixed in the libfreebl3-3.69.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:19:08.673425Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:4235-1","title":"Security update for MozillaFirefox, mozilla-nspr and mozilla-nss","description":"This update for MozillaFirefox, mozilla-nss and mozilla-nspr fixes the following issues:\n\nIssues fixed in MozillaFirefox:\n\n- Update to Firefox ESR 60.4 (bsc#1119105)\n- CVE-2018-17466: Fixed a buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11\n- CVE-2018-18492: Fixed a use-after-free with select element\n- CVE-2018-18493: Fixed a buffer overflow in accelerated 2D canvas with Skia\n- CVE-2018-18494: Fixed a Same-origin policy violation using location attribute and performance.getEntries\n  to steal cross-origin URLs\n- CVE-2018-18498: Fixed a integer overflow when calculating buffer sizes for images\n- CVE-2018-12405: Fixed a few memory safety bugs\n\nIssues fixed in mozilla-nss:\n\n- Update to NSS 3.40.1 (bsc#1119105)\n- CVE-2018-12404: Fixed a cache side-channel variant of the Bleichenbacher attack (bsc#1119069)\n- CVE-2018-12384: Fixed an issue in the SSL handshake. NSS responded to an\n  SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. (bsc#1106873)\n- CVE-2018-0495: Fixed a memory-cache side-channel attack with ECDSA signatures (bsc#1097410)\n- Fixed a decryption failure during FFDHE key exchange\n- Various security fixes in the ASN.1 code\n\nIssues fixed in mozilla-nspr:\n\n- Update mozilla-nspr to 4.20 (bsc#1119105)\n","status":"published","published":"2018-12-21T17:47:33Z","modified":"2026-02-04T04:35:50.433821Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2018:4236-1","title":"Security update for MozillaFirefox, mozilla-nspr and mozilla-nss","description":"This update for MozillaFirefox, mozilla-nss and mozilla-nspr fixes the following issues:\n\nIssues fixed in MozillaFirefox:\n\n- Update to Firefox ESR 60.4 (bsc#1119105)\n- CVE-2018-17466: Fixed a buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11\n- CVE-2018-18492: Fixed a use-after-free with select element\n- CVE-2018-18493: Fixed a buffer overflow in accelerated 2D canvas with Skia\n- CVE-2018-18494: Fixed a Same-origin policy violation using location attribute and performance.getEntries\n  to steal cross-origin URLs\n- CVE-2018-18498: Fixed a integer overflow when calculating buffer sizes for images\n- CVE-2018-12405: Fixed a few memory safety bugs\n\nIssues fixed in mozilla-nss:\n\n- Update to NSS 3.40.1 (bsc#1119105)\n- CVE-2018-12404: Fixed a cache side-channel variant of the Bleichenbacher attack (bsc#1119069)\n- CVE-2018-12384: Fixed an issue in the SSL handshake. NSS responded to an\n  SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. (bsc#1106873)\n- CVE-2018-0495: Fixed a memory-cache side-channel attack with ECDSA signatures (bsc#1097410)\n- Fixed a decryption failure during FFDHE key exchange\n- Various security fixes in the ASN.1 code\n\nIssues fixed in mozilla-nspr:\n\n- Update mozilla-nspr to 4.20 (bsc#1119105)\n","status":"published","published":"2018-12-21T17:49:53Z","modified":"2026-02-04T03:42:47.45532Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2018:4236-2","title":"Security update for MozillaFirefox, mozilla-nspr and mozilla-nss","description":"This update for MozillaFirefox, mozilla-nss and mozilla-nspr fixes the following issues:\n\nIssues fixed in MozillaFirefox:\n\n- Update to Firefox ESR 60.4 (bsc#1119105)\n- CVE-2018-17466: Fixed a buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11\n- CVE-2018-18492: Fixed a use-after-free with select element\n- CVE-2018-18493: Fixed a buffer overflow in accelerated 2D canvas with Skia\n- CVE-2018-18494: Fixed a Same-origin policy violation using location attribute and performance.getEntries\n  to steal cross-origin URLs\n- CVE-2018-18498: Fixed a integer overflow when calculating buffer sizes for images\n- CVE-2018-12405: Fixed a few memory safety bugs\n\nIssues fixed in mozilla-nss:\n\n- Update to NSS 3.40.1 (bsc#1119105)\n- CVE-2018-12404: Fixed a cache side-channel variant of the Bleichenbacher attack (bsc#1119069)\n- CVE-2018-12384: Fixed an issue in the SSL handshake. NSS responded to an\n  SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. (bsc#1106873)\n- CVE-2018-0495: Fixed a memory-cache side-channel attack with ECDSA signatures (bsc#1097410)\n- Fixed a decryption failure during FFDHE key exchange\n- Various security fixes in the ASN.1 code\n\nIssues fixed in mozilla-nspr:\n\n- Update mozilla-nspr to 4.20 (bsc#1119105)\n","status":"published","published":"2019-04-15T15:37:00Z","modified":"2026-02-04T03:20:23.659661Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0273-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox, mozilla-nss fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-18500: Fixed a use-after-free parsing HTML5 stream (bsc#1122983).\n- CVE-2018-18501: Fixed multiple memory safety bugs (bsc#1122983).\n- CVE-2018-18505: Fixed a privilege escalation through IPC channel messages (bsc#1122983).\n- CVE-2018-12404: Cache side-channel variant of the Bleichenbacher attack (bsc#1119069).\n\nNon-security issue fixed:\n\n- Update to MozillaFirefox ESR 60.5.0\n- Update to mozilla-nss 3.41.1\n","status":"published","published":"2019-02-06T15:48:32Z","modified":"2026-02-04T02:15:09.719023Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3850-1","title":"nss vulnerabilities","description":"Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation.\nA local attacker could possibly use this issue to perform a cache-timing\nattack and recover private ECDSA keys. (CVE-2018-0495)\n\nIt was discovered that NSS incorrectly handled certain v2-compatible\nClientHello messages. A remote attacker could possibly use this issue to\nperform a replay attack. (CVE-2018-12384)\n\nIt was discovered that NSS incorrectly handled certain padding oracles. A\nremote attacker could possibly use this issue to perform a variant of the\nBleichenbacher attack. (CVE-2018-12404)\n","status":"published","published":"2019-01-09T17:41:27Z","modified":"2026-04-22T09:52:38.331565Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}