CVE-2018-12384

CVE-2018-12384 describes a medium-severity vulnerability in Mozilla Network Security Services (NSS) versions prior to 3.39, where a server handling an SSLv2-compatible ClientHello request sends an all-zero random value instead of generating a new one. This flaw allows for full malleability of the ClientHello for TLS 1.2, though it does not affect TLS 1.3. The vulnerability has a CVSS score of 5.9, indicating a network-based attack with high impact on confidentiality and high attack complexity, but no impact on integrity or availability. There is currently no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage.