Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-12384: A flaw was found in the way NSS responded to an SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. A man-in-the-middle attacker could use this flaw in a passive replay attack. 1622089: CVE-2018-12384 nss: ServerHello.random is all zeros when handling a v2-compatible ClientHello
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | nss | 0:3.36.0-7.amzn2 |
| Amazon Linux · 2 | nss-debuginfo | 0:3.36.0-7.amzn2 |
| Amazon Linux · 2 | nss-devel | 0:3.36.0-7.amzn2 |
| Amazon Linux · 2 | nss-pkcs11-devel | 0:3.36.0-7.amzn2 |
| Amazon Linux · 2 | nss-sysinit | 0:3.36.0-7.amzn2 |
| Amazon Linux · 2 | nss-tools | 0:3.36.0-7.amzn2 |
Vulnerabilities 1
-
Unscored —
When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-z…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-12384.html