PT-2018-2116 · Arm+1 · Mbed Tls+1

Adi Shamir + 5 · Publicado 2015-12-04 · Atualizado 2026-06-05 · CVE-2018-19608

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 2.14.1 Mbed TLS versions prior to 2.7.8 Mbed TLS versions prior to 2.1.17

Description The issue is related to a local synchronization problem during RSA decryption in Mbed TLS, allowing a local unprivileged attacker to recover the plaintext of RSA decryption. This affects RSA-without-(EC)DH(E) cipher suites. The vulnerability can be exploited to gain access to protected information.

Recommendations For versions prior to 2.14.1, update to version 2.14.1 or later. For versions prior to 2.7.8, update to version 2.7.8 or later. For versions prior to 2.1.17, update to version 2.1.17 or later.

Correção

Buffer Overflow

Improper Privilege Management

Enumeração de Fraquezas

CWE-119

CWE-310

CWE-269

Identificadores relacionados

ALT-PU-2015-2061

ALT-PU-2018-1495

BDU:2019-00068

CVE-2018-19608

MGASA-2019-0027

OPENSUSE-SU-2024:11043-1

Produtos afetados

Alt Linux

Mbed Tls

Referências · 26

• https://osv.dev/vulnerability/MGASA-2019-0027 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-19608 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00068 · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-2784 · Nota
• https://security.alpinelinux.org/vuln/CVE-2018-19608 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=24064 · Nota
• https://t.me/cveNotify/166266 · Publicação no Telegram
• http://cat.eyalro.net · Nota
• https://suse.com/security/cve/CVE-2018-0488 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:11043-1 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/JPMHKBJDZVFFML2CJYXG3ELX7ADDG6ET · Aviso do Fabricante
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03 · Nota
• https://advisories.mageia.org/MGASA-2019-0027.html · Nota de Segurança
• https://securitylab.ru/news/496778.php · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-19608 · Aviso do Fabricante