1. Home
  2. Vulnerabilities
  3. CVE-2018-0497

CVE-2018-0497

CVSS v3.0 5.9 (Medium)
59% Progress
CVSS v2.0 4.3 (Medium)
43% Progress
EPSS 0.36 % (73th)
0.36% Progress
Affected Products 2
Advisories 8
Info CVSS EPSS Affected Configurations References Security Advisories Packages & Software OVAL Tools, Exploits & PoC Graph Web & Social Timeline

ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recovery (for a CBC based ciphersuite) via a timing-based side-channel attack. This vulnerability exists because of an incorrect fix (with a wrong SHA-384 calculation) for CVE-2013-0169.

Weaknesses
CWE-NVD-noinfo
Related CVEs
CVE Status
PUBLISHED
CNA
Debian GNU/Linux
Published Date
2018-07-28 17:29:00
(6 years ago)
Updated Date
2020-02-10 16:15:13
(4 years ago)

Affected Products

Arm

Debian

Configuration #1

    CPE23 From Up To
  Arm Mbed Tls prior 2.1.14 version cpe:2.3:a:arm:mbed_tls < 2.1.14
  Arm Mbed Tls from 2.2.0 version and prior 2.7.5 version cpe:2.3:a:arm:mbed_tls >= 2.2.0 < 2.7.5
  Arm Mbed Tls from 2.8.0 version and prior 2.12.0 version cpe:2.3:a:arm:mbed_tls >= 2.8.0 < 2.12.0

Configuration #2

    CPE23 From Up To
  Debian Linux 8.0 cpe:2.3:o:debian:debian_linux:8.0
  Debian Linux 9.0 cpe:2.3:o:debian:debian_linux:9.0