Mozilla Network Security Services CVE-2018-12404 Information Disclosure Vulnerability

Bugtraq ID:	107260
Class:	Design Error
CVE:	CVE-2018-12404
Remote:	Yes
Local:	No
Published:	Nov 30 2018 12:00AM
Updated:	Apr 17 2019 06:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Ubuntu Ubuntu Linux 18.10 Ubuntu Ubuntu Linux 18.04 LTS Ubuntu Ubuntu Linux 16.04 LTS Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 ESM Redhat Virtualization 4 Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Redhat Enterprise Linux 5 Oracle Communications Messaging Server 8.1 Oracle Communications Messaging Server 8.0 Mozilla Network Security Services (NSS) 3.36.5 Mozilla Network Security Services (NSS) 3.36.4 Mozilla Network Security Services (NSS) 3.36.3 Mozilla Network Security Services (NSS) 3.36.2 Mozilla Network Security Services (NSS) 3.36.1 Mozilla Network Security Services (NSS) 3.34.1 Mozilla Network Security Services (NSS) 3.31.1 Mozilla Network Security Services (NSS) 3.30.2 Mozilla Network Security Services (NSS) 3.30.1 Mozilla Network Security Services (NSS) 3.29.5 Mozilla Network Security Services (NSS) 3.29.4 Mozilla Network Security Services (NSS) 3.29.3 Mozilla Network Security Services (NSS) 3.29.2 Mozilla Network Security Services (NSS) 3.29.1 Mozilla Network Security Services (NSS) 3.28.4 Mozilla Network Security Services (NSS) 3.28 Mozilla Network Security Services (NSS) 3.21.4 Mozilla Network Security Services (NSS) 3.21.1 Mozilla Network Security Services (NSS) 3.20.2 Mozilla Network Security Services (NSS) 3.20.1 Mozilla Network Security Services (NSS) 3.19.1 Mozilla Network Security Services (NSS) 3.17.3 Mozilla Network Security Services (NSS) 3.17.1 Mozilla Network Security Services (NSS) 3.15.4 Mozilla Network Security Services (NSS) 3.15.3 Mozilla Network Security Services (NSS) 3.15.2 Mozilla Network Security Services (NSS) 3.15.1 Mozilla Network Security Services (NSS) 3.14.5 Mozilla Network Security Services (NSS) 3.14.4 Mozilla Network Security Services (NSS) 3.12.10 Mozilla Network Security Services (NSS) 3.12.8 Mozilla Network Security Services (NSS) 3.12.5 Mozilla Network Security Services (NSS) 3.12.4 Mozilla Network Security Services (NSS) 3.12.3 Mozilla Network Security Services (NSS) 3.12.2 Mozilla Network Security Services (NSS) 3.12.1 Mozilla Network Security Services (NSS) 3.11.3 Mozilla Network Security Services (NSS) 3.9.2 Mozilla Network Security Services (NSS) 3.9 + Mozilla Browser 1.5 Mozilla Network Security Services (NSS) 3.8 + Galeon Galeon Browser 1.2.13 + Mozilla Browser 1.4.1 + Mozilla Browser 1.4.1 + Mozilla Browser 1.4 b + Mozilla Browser 1.4 b + Mozilla Browser 1.4 a + Mozilla Browser 1.4 a + Mozilla Browser 1.4 + Mozilla Browser 1.4 Mozilla Network Security Services (NSS) 3.7.7 Mozilla Network Security Services (NSS) 3.7.5 Mozilla Network Security Services (NSS) 3.7.3 Mozilla Network Security Services (NSS) 3.7.2 Mozilla Network Security Services (NSS) 3.7.1 Mozilla Network Security Services (NSS) 3.7 Mozilla Network Security Services (NSS) 3.6.1 Mozilla Network Security Services (NSS) 3.6 Mozilla Network Security Services (NSS) 3.5 Mozilla Network Security Services (NSS) 3.3.2 Mozilla Network Security Services (NSS) 3.3.1 Mozilla Network Security Services (NSS) 3.3 Mozilla Network Security Services (NSS) 3.2.1 Mozilla Network Security Services (NSS) 3.2 Mozilla Network Security Services (NSS) 3.40 Mozilla Network Security Services (NSS) 3.36 Mozilla Network Security Services (NSS) 3.35 Mozilla Network Security Services (NSS) 3.34 Mozilla Network Security Services (NSS) 3.33 Mozilla Network Security Services (NSS) 3.32 Mozilla Network Security Services (NSS) 3.31 Mozilla Network Security Services (NSS) 3.30 Mozilla Network Security Services (NSS) 3.29 Mozilla Network Security Services (NSS) 3.24.0 Mozilla Network Security Services (NSS) 3.23 Mozilla Network Security Services (NSS) 3.21 Mozilla Network Security Services (NSS) 3.20 Mozilla Network Security Services (NSS) 3.19.2.3 Mozilla Network Security Services (NSS) 3.17 Mozilla Network Security Services (NSS) 3.16.5 Mozilla Network Security Services (NSS) 3.16.2.1 Mozilla Network Security Services (NSS) 3.16 Mozilla Network Security Services (NSS) 3.15.5 Mozilla Network Security Services (NSS) 3.15.3.1 Mozilla Network Security Services (NSS) 3.15 Mozilla Network Security Services (NSS) 3.14.3 Mozilla Network Security Services (NSS) 3.14.2 Mozilla Network Security Services (NSS) 3.14.1 Mozilla Network Security Services (NSS) 3.14 Mozilla Network Security Services (NSS) 3.13.4 Mozilla Network Security Services (NSS) 3.13.3 Mozilla Network Security Services (NSS) 3.12.9 Mozilla Network Security Services (NSS) 3.12.7 Mozilla Network Security Services (NSS) 3.12.6 Mozilla Network Security Services (NSS) 3.12.3.2 Mozilla Network Security Services (NSS) 3.12.3.1 Mozilla Network Security Services (NSS) 3.12.11 Mozilla Network Security Services (NSS) 3.12 Mozilla Network Security Services (NSS) 3.11 F5 Traffix SDC 5.1 F5 Traffix SDC 5.0 F5 Traffix SDC 4.4
Not Vulnerable:	Mozilla Network Security Services (NSS) 3.40.1 Mozilla Network Security Services (NSS) 3.36.6

Mozilla Network Security Services CVE-2018-12404 Information Disclosure Vulnerability

Mozilla Network Security Services is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in further attacks.

Mozilla Network Security Services CVE-2018-12404 Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Mozilla Network Security Services CVE-2018-12404 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Mozilla Network Security Services CVE-2018-12404 Information Disclosure Vulnerability

References:

• Mozilla Homepage (Mozilla Foundation)
  
• Mozilla Network Security Services Home Page (Mozilla)
  
• NSS 3.36.6 release notes (Mozilla)
  
• NSS 3.40.1 release notes (Mozilla)
  
• The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations (Eyal Ronen)
  
• CVE-2018-12404 nss: Cache side-channel variant of the Bleichenbacher attack (Redhat)
  
• K10281096: TLS in Mozilla NSS vulnerability CVE-2018-12404 (F5)
  
• Oracle Critical Patch Update Advisory - April 2019 (Oracle)
  
• Red Hat Bugzilla �?? Bug 1657913 (Red Hat Bugzilla)
  
• USN-3850-1: NSS vulnerabilities (Ubuntu)
  
• USN-3850-2: NSS vulnerabilities (Ubuntu)