CVE-2018-12404: A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encry...

Security readout for executives and security teams

This flaw affects Mozilla Network Security Services before NSS 3.41. Under RSA-encrypted handshakes, a cache side channel could let an attacker work toward decrypting protected content. The business concern is older NSS in browsers, servers, operating systems, or embedded products that still support affected TLS behavior. Exposure is most likely where NSS before 3.41 is present in internet-facing services, client software, OS packages, or vendor appliances. Linux distribution, Oracle, Debian LTS, Siemens, and CISA ICS references indicate downstream product impact should be checked, not assumed from application names alone. Treat this as a patch and exposure-management issue, not an emergency based on the provided evidence. Prioritize remediation for internet-facing and sensitive-data systems, especially where legacy NSS versions or embedded vendor products remain in service. Mitigation focus: Upgrade NSS to 3.41 or later, or a vendor-supported backported fixed package.; Apply applicable security updates from your OS or product vendor advisories.; Inventory embedded products and appliances that may bundle NSS independently..

Prepared

Jun 6, 2026, 21:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.