When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nss | Aug 22, 2024 | Apr 29, 2019 |
| Amazon Linux Ami 2 | — | Upgrade nssUpgrade nss-pkcs11-develUpgrade nss-debuginfoUpgrade nss-toolsUpgrade nss-develUpgrade nss-sysinit | Apr 27, 2020 | Apr 29, 2019 |
| Amazon_linux | — | Upgrade nss | Oct 25, 2018 | Sep 26, 2018 |
| Centos_linux | — | Upgrade nss-pkcs11-develUpgrade nssUpgrade nss-debuginfoUpgrade nss-toolsUpgrade nss-develUpgrade nss-sysinit | Oct 2, 2018 | Sep 26, 2018 |
| Debian | — | Upgrade nss | Jul 30, 2024 | Apr 29, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nss-develUpgrade nss-sysinitUpgrade nss-toolsUpgrade nss | Nov 6, 2018 | Sep 3, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nssUpgrade nss-develUpgrade nss-toolsUpgrade nss-sysinit | Nov 8, 2018 | Sep 3, 2018 |
| Oracle_linux | — | Upgrade nss-develUpgrade nss-pkcs11-develUpgrade nssUpgrade nss-toolsUpgrade nss-sysinit | Sep 26, 2018 | Sep 3, 2018 |
| Redhat_linux | — | Upgrade nssUpgrade nss-pkcs11-develUpgrade nss-develUpgrade nss-debuginfoUpgrade nss-toolsUpgrade nss-sysinit | Sep 26, 2018 | Sep 25, 2018 |
| Suse | — | Upgrade mozilla-nss-certsUpgrade mozilla-nssUpgrade mozilla-nss-32bitUpgrade mozilla-nss-toolsUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-develUpgrade mozilla-nss-certs-32bitUpgrade libfreebl3-32bitUpgrade mozilla-nsprUpgrade libfreebl3Upgrade libsoftokn3-hmacUpgrade mozilla-nspr-32bitUpgrade libsoftokn3-hmac-32bitUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefoxUpgrade libfreebl3-hmacUpgrade libfreebl3-hmac-32bitUpgrade mozilla-nss-sysinit-32bitUpgrade mozilla-nspr-develUpgrade MozillaFirefox-develUpgrade libsoftokn3-32bitUpgrade libsoftokn3Upgrade mozilla-nss-sysinit | Dec 14, 2018 | Sep 26, 2018 |
| Ubuntu | — | Upgrade libnss3 | Jan 16, 2019 | Sep 26, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub