Security readout for executives and security teams
Plain-English summary
CVE-2018-12384 is a cryptographic handshake flaw in Mozilla NSS before 3.39. For certain SSLv2-compatible ClientHello handling used with TLS 1.2, the server sends an all-zero random value instead of generating a fresh one. The provided sources do not report active exploitation or quantify severity.
Executive priority
Prioritize remediation as part of cryptographic library maintenance, with higher urgency for internet-facing or sensitive TLS services using NSS before 3.39. There is no source-backed evidence here for emergency response based on active exploitation.
Technical view
NSS versions prior to 3.39 mishandle SSLv2-compatible ClientHello requests by returning an all-zero server random. The CVE states this creates full ClientHello malleability for SSLv2-compatible handling used for TLS 1.2. TLS 1.3 is explicitly not impacted.
Likely exposure
Exposure is limited to software, appliances, or vendor products using NSS before 3.39 and accepting the affected TLS 1.2 handshake path. Products using NSS through operating system or application bundles may depend on vendor backports rather than raw NSS version numbers.
Exploitation context
The source bundle does not include KEV listing, public exploitation evidence, CVSS scoring, or exploit details. Treat exploitation status as unconfirmed. The issue is relevant to cryptographic integrity of the handshake, but business impact depends on where vulnerable NSS is deployed.
Researcher notes
The strongest source detail is the NSS version boundary: all versions before 3.39. Evidence gaps include missing CVSS, CWE, affected downstream product list, and confirmed exploit status. Avoid extrapolating beyond NSS and vendor advisories.
Mitigation direction
- Inventory applications and platforms that use NSS.
- Upgrade or vendor-patch NSS to 3.39 or later.
- Review Oracle CPU October 2019 for Oracle-packaged exposure.
- Follow vendor TLS guidance where immediate upgrade is unavailable.
Validation and detection
- Identify installed NSS package and runtime library versions.
- Confirm vendor advisories mark the product fixed or not affected.
- Check whether applications dynamically link to vulnerable NSS builds.
- Verify TLS 1.3-only paths are outside this CVE scope.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-12384 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12384CVE reference · x_refsource_CONFIRM
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.