CVE-2018-12404

Published: 12 December 2018

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.

Priority

Medium

CVSS 3 base score: 5.9

Status

Package Release Status
nss
Launchpad, Ubuntu, Debian
Upstream
Released (3.36.6,3.40.1,2:3.41-1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (2:3.35-2ubuntu2.1)
Ubuntu 16.04 LTS (Xenial Xerus)
Released (2:3.28.4-0ubuntu0.16.04.4)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (2:3.28.4-0ubuntu0.14.04.4)
Patches:
Upstream: https://hg.mozilla.org/projects/nss/rev/4b966fea84c8 (3.41)
Upstream: https://hg.mozilla.org/projects/nss/rev/9d1be6a2e610 (3.41)
Upstream: https://hg.mozilla.org/projects/nss/rev/f5ef34273311 (3.41)
Upstream: https://hg.mozilla.org/projects/nss/rev/93b536c98e60 (3.36)
Upstream: https://hg.mozilla.org/projects/nss/rev/2ac9939c87cc (3.36)
Upstream: https://hg.mozilla.org/projects/nss/rev/f550aef6074c (3.36)