CVE-2018-9988

Опубликовано: 10 апр. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

Ссылки

https://github.com/ARMmbed/mbedtls/commit/027f84c69f4ef30c0693832a6c396ef19e563ca1
Patch
Third Party Advisory
https://github.com/ARMmbed/mbedtls/commit/a1098f81c252b317ad34ea978aea2bc47760b215
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html
Mailing List
Third Party Advisory
https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released
Release Notes
Vendor Advisory
https://github.com/ARMmbed/mbedtls/commit/027f84c69f4ef30c0693832a6c396ef19e563ca1
Patch
Third Party Advisory
https://github.com/ARMmbed/mbedtls/commit/a1098f81c252b317ad34ea978aea2bc47760b215
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html
Mailing List
Third Party Advisory
https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*

Версия до 2.1.11 (исключая)

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*

Версия от 2.7.0 (включая) до 2.7.2 (исключая)

cpe:2.3:a:trustedfirmware:mbed_tls:2.8.0:rc1:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 82%

0.02158

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2018-9988

CVSS3: 7.5

ubuntu

больше 8 лет назад

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

CVE-2018-9988

CVSS3: 7.5

debian

больше 8 лет назад

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffe ...

GHSA-h9j8-4v77-hmr3

CVSS3: 7.5

github

больше 4 лет назад

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

ALT-PU-2015-2061

CVSS3: 7.5

altlinux

почти 11 лет назад

ALT-PU-2015-2061: package `mbedtls` update to version 2.2.0-alt1

ALT-PU-2018-1495

CVSS3: 7.5

altlinux

больше 8 лет назад

ALT-PU-2018-1495: package `mbedtls` update to version 2.8.0-alt1.S1

EPSS

Процентиль: 82%

0.02158

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-125