CVE-2018-12404

Publication date 12 December 2018

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
nss	18.10 cosmic	Fixed 2:3.36.1-1ubuntu1.1
	18.04 LTS bionic	Fixed 2:3.35-2ubuntu2.1
	16.04 LTS xenial	Fixed 2:3.28.4-0ubuntu0.16.04.4
	14.04 LTS trusty	Fixed 2:3.28.4-0ubuntu0.14.04.4

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
nss	Upstream: https://hg.mozilla.org/projects/nss/rev/4b966fea84c8 Upstream: https://hg.mozilla.org/projects/nss/rev/9d1be6a2e610 Upstream: https://hg.mozilla.org/projects/nss/rev/f5ef34273311 Upstream: https://hg.mozilla.org/projects/nss/rev/93b536c98e60 Upstream: https://hg.mozilla.org/projects/nss/rev/2ac9939c87cc Upstream: https://hg.mozilla.org/projects/nss/rev/f550aef6074c

Severity score breakdown

Parameter	Value
Base score	5.9 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE-2018-12404

Cvss 3 Severity Score

Description

Status

Patch details

Severity score breakdown

References

Related Ubuntu Security Notices (USN)

Other references