CVE-2018-12404

Name of the Vulnerable Software and Affected Versions Network Security Services (NSS) versions prior to 3.41

Description A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This issue is related to errors in cryptographic transformations and can be exploited to gain unauthorized access to protected information. The attack is a variant of the Adaptive Chosen Ciphertext attack, also known as the Bleichenbacher attack. It may also involve downgrading the used TLS protocol version, allowing an attacker to access protected information using a side channel.

Recommendations For NSS versions prior to 3.41, update to version 3.41 or later to resolve the issue. As a temporary workaround, consider restricting the use of RSA encryption for handshakes until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.