CVE-2017-18187

CRITICAL 9.8CVE-2017-18187 · Published 14/02/2018 · updated 17/06/2026

In short

CVE-2017-18187 is a CRITICAL (CVSS 9.8) vulnerability affecting mbed tls (arm).
Chance of exploitation in the next 30 days (EPSS): 3.1%, higher than 87.8% of all vulnerabilities.
Fix: update to 2.7.0 or later.

Package	Affected versions	Patched versions
mbed tls arm	`< 2.7.0`	`2.7.0`

Description

In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c.

References

securityfocus.com/bid/103055 · Third Party Advisory
ARMmbed/mbedtls · Third Party Advisory
ARMmbed/mbedtls commit 83c9f49 · Patch
security.gentoo.org/glsa/201804-19 · Third Party Advisory
usn.ubuntu.com/4267-1
debian.org/security/2018/dsa-4138 · Third Party Advisory
debian.org/security/2018/dsa-4147 · Third Party Advisory

More vulnerabilities in mbed tls

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mbed tls

arm

< 2.7.0

2.7.0

More vulnerabilities in mbed tls

See all →