CVE-2018-0498

Опубликовано: 28 июл. 2018

Источник: nvd

CVSS3: 4.7

CVSS2: 1.9

EPSS Низкий

Описание

ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows local users to achieve partial plaintext recovery (for a CBC based ciphersuite) via a cache-based side-channel attack.

Ссылки

https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html
Mailing List
Third Party Advisory
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02
Mitigation
Third Party Advisory
https://usn.ubuntu.com/4267-1/
https://www.debian.org/security/2018/dsa-4296
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html
Mailing List
Third Party Advisory
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02
Mitigation
Third Party Advisory
https://usn.ubuntu.com/4267-1/
https://www.debian.org/security/2018/dsa-4296
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*

Версия до 2.1.14 (исключая)

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*

Версия от 2.2.0 (включая) до 2.7.5 (исключая)

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*

Версия от 2.8.0 (включая) до 2.12.0 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 31%

0.00373

Низкий

4.7 Medium

CVSS3

1.9 Low

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2018-0498

CVSS3: 4.7

ubuntu

больше 8 лет назад

ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows local users to achieve partial plaintext recovery (for a CBC based ciphersuite) via a cache-based side-channel attack.

CVE-2018-0498

CVSS3: 4.7

debian

больше 8 лет назад

ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows loc ...

GHSA-f3f3-2pmh-mpg9

CVSS3: 4.7

github

больше 4 лет назад

ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows local users to achieve partial plaintext recovery (for a CBC based ciphersuite) via a cache-based side-channel attack.

ALT-PU-2019-1599

CVSS3: 5.9

altlinux

больше 7 лет назад

ALT-PU-2019-1599: package `mbedtls` update to version 2.16.1-alt1

EPSS

Процентиль: 31%

0.00373

Низкий

4.7 Medium

CVSS3

1.9 Low

CVSS2

Дефекты

NVD-CWE-noinfo