CVE-2018-0488 ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap co...
CriticalCVSS 9.8
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mbedtls(Debian:12) | < 2.7.0-2 | 2.7.0-2 |
| debian/mbedtls(Debian:13) | < 2.7.0-2 | 2.7.0-2 |
| debian/mbedtls(Debian:14) | < 2.7.0-2 | 2.7.0-2 |
| Arm Ltd mbed tls | >= 1.3.0, < 1.3.22 | 1.3.22 |
| Arm Ltd mbed tls | >= 2.1.0, < 2.1.10 | 2.1.10 |
| Arm Ltd mbed tls | >= 2.2.0, < 2.7.0 | 2.7.0 |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| alpine/mbedtls(Alpine:v3.10) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.11) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.12) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.13) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.14) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.15) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.16) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.17) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.18) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.19) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.20) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.21) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.22) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.23) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.24) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.8) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls(Alpine:v3.9) | < 2.7.0-r0 | 2.7.0-r0 |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/mbedtls2(Alpine:v3.20) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls2(Alpine:v3.21) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls2(Alpine:v3.22) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls2(Alpine:v3.23) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls2(Alpine:v3.24) | < 2.7.0-r0 | 2.7.0-r0 |
| alpine/mbedtls3(Alpine:v3.24) | < 2.7.0-r0 | 2.7.0-r0 |
References
- Debian Security Tracker CVE-2018-0488 vendor-advisory
- 103057 third-party-advisory vdb-entry
- GLSA-201804-19 third-party-advisory vendor-advisory
- tls.mbed.org mitigation vendor-advisory
- USN-4267-1 vendor-advisory
- DSA-4138 third-party-advisory vendor-advisory
- DSA-4147 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking