PT-2018-2116 · Arm+1 · Mbed Tls+1

Adi Shamir + 5 · Published 2015-12-04 · Updated 2026-06-05 · CVE-2018-19608

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 2.14.1 Mbed TLS versions prior to 2.7.8 Mbed TLS versions prior to 2.1.17

Description The issue is related to a local synchronization problem during RSA decryption in Mbed TLS, allowing a local unprivileged attacker to recover the plaintext of RSA decryption. This affects RSA-without-(EC)DH(E) cipher suites. The vulnerability can be exploited to gain access to protected information.

Recommendations For versions prior to 2.14.1, update to version 2.14.1 or later. For versions prior to 2.7.8, update to version 2.7.8 or later. For versions prior to 2.1.17, update to version 2.1.17 or later.

Fix

Buffer Overflow

Improper Privilege Management

Weakness Enumeration

CWE-119

CWE-310

CWE-269

Related Identifiers

ALT-PU-2015-2061

ALT-PU-2018-1495

BDU:2019-00068

CVE-2018-19608

MGASA-2019-0027

OPENSUSE-SU-2024:11043-1

Affected Products

Alt Linux

Mbed Tls

References · 26

• https://osv.dev/vulnerability/MGASA-2019-0027 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-19608 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00068 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11043-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/JPMHKBJDZVFFML2CJYXG3ELX7ADDG6ET · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0027.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-19608 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-19608 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19608 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2018-19608 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-19608 · Security Note
• https://ubuntu.com/security/CVE-2018-19608 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-19608 · Vendor Advisory
• https://suse.com/security/cve/CVE-2017-2784 · Note
• https://security.alpinelinux.org/vuln/CVE-2018-19608 · Note