Security Bulletin: IBM MQ Appliance is affected by a Mozilla Network Security Services (NSS) vulnerability (CVE-2018-12384)

Summary

IBM MQ Appliance has addressed the following Mozilla Network Security Services (NSS) vulnerability.

Vulnerability Details

CVEID: CVE-2018-12384
DESCRIPTION: Mozilla Network Security Services (NSS), as used in Mozilla Firefox, could allow a remote attacker to obtain sensitive information, caused by the improper handling of an SSLv2-compatible ClientHello message. By conducting a passive replay attack, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base Score: 4.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/150436&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

IBM MQ Appliance 8.0
Maintenance levels between 8.0.0.0 and 8.0.0.11

IBM MQ Appliance 9.1 Long Term Support (LTS) Release
Maintenance level 9.1.0.0

Remediation/Fixes

IBM MQ Appliance 8.0
Apply iFix IT27359 , or later.

IBM MQ Appliance 9.1 Long Term Support (LTS) Release
Apply fixpack 9.1.0.1 , or later.

Workarounds and Mitigations

None