mozilla network-security-services CVE-2018-12384 is a vulnerability in Mozilla Network Security Services
Published on April 29, 2019

When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.

NVD


Products Associated with CVE-2018-12384

Want to know whenever a new CVE is published for Mozilla Network Security Services? stack.watch will email you.

Mozilla Network Security Services
 

Affected Versions

Network Security Services (NSS) Version All versions prior to NSS 3.39 is affected by CVE-2018-12384

Exploit Probability

EPSS
0.78%
Percentile
73.35%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.