VDB
ALPINE-CVE-2018-12384
ALPINE-CVE-2018-12384
PUBLISHED
CVSS 5.900000095367432 MEDIUM
When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.
Risk Scores
CVSS 3.0
5.900000095367432
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.23 | nss | 0, 0, 0 |
| Alpine:v3.21 | nss | 3.12.10-r0, 0, 0 |
| Alpine:v3.12 | nss | 0, 0, 0 |
| Alpine:v3.10 | nss | 3.23-r0, 3.12.10-r0, 3.12.6-r0 |
| Alpine:v3.20 | nss | 3.12.11-r1, 3.12.11-r0, 3.19.2-r1 |
| Alpine:v3.8 | nss | 3.17.3-r0, 3.18-r0, 3.18.1-r0 |
| Alpine:v3.24 | nss | 0, 0 |
| Alpine:v3.22 | nss | 3.15.5-r0, 3.15.4-r0, 3.15.3.1-r0 |
| Alpine:v3.9 | nss | 3.32-r0, 0, 3.12.11-r0 |
| Alpine:v3.19 | nss | 3.19.2-r1, 0, 3.38-r1 |
| Alpine:v3.11 | nss | 3.38-r1, 0, 0 |
Timeline
- Apr 29, 2019 CVE Published
- Apr 30, 2026 Distribution Patch
- Jun 9, 2026 CVE Updated