CVE-2018-12404
CVE-2018-12404 is a medium-severity vulnerability in Mozilla Network Security Services with a CVSS 3.x base score of 5.9. Its EPSS exploit-prediction score of 44% places it in the 99th percentile, indicating an elevated likelihood of exploitation.
Key facts
- Severity: Medium (CVSS 3.x base score 5.9)
- CVSS v2: 4.3
- EPSS exploit prediction: 44% (99th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Mozilla Network Security Services
- Published:
- Last modified:
Description
A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.
Frequently asked questions
- What is CVE-2018-12404?
- A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.
- How severe is CVE-2018-12404?
- CVE-2018-12404 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2018-12404 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 44% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2018-12404?
- CVE-2018-12404 affects Mozilla Network Security Services. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2018-12404?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2018-12404 published?
- CVE-2018-12404 was published on 2019-05-02 and last updated on 2026-06-17.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html
- http://www.securityfocus.com/bid/107260
- https://access.redhat.com/errata/RHSA-2019:2237
- https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404
- https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf
- https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html
- https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Affected products (1)
- cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*
More vulnerabilities in Mozilla Network Security Services
- CVE-2014-1544 — Critical (CVSS 10.0): Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services…
- CVE-2019-17006 — Critical (CVSS 9.8): In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases…
- CVE-2017-5461 — Critical (CVSS 9.8): Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and…
- CVE-2015-7182 — Critical (CVSS 9.8): Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x…
- CVE-2014-1490 — Critical (CVSS 9.3): Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before…
- CVE-2009-2404 — Critical (CVSS 9.3): Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as…