CVE-2018-0497

MEDIUM 5.9CVE-2018-0497 · Published 28/07/2018 · updated 17/06/2026

In short

CVE-2018-0497 is a MEDIUM (CVSS 5.9) vulnerability affecting mbed tls (arm).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.3% of all vulnerabilities.
Fix: update to 2.7.5, 2.12.0, 2.1.14 or later.

Package	Affected versions	Patched versions
mbed tls arm	`≥ 2.2.0, < 2.7.5≥ 2.8.0, < 2.12.0< 2.1.14`	`2.7.52.12.02.1.14`

Description

ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recovery (for a CBC based ciphersuite) via a timing-based side-channel attack. This vulnerability exists because of an incorrect fix (with a wrong SHA-384 calculation) for CVE-2013-0169.

References

lists.debian.org/debian-lts-announce/2018/09/msg00029.html · Mailing List
tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02 · Mitigation
usn.ubuntu.com/4267-1
debian.org/security/2018/dsa-4296 · Third Party Advisory

More vulnerabilities in mbed tls

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mbed tls

arm

≥ 2.2.0, < 2.7.5≥ 2.8.0, < 2.12.0< 2.1.14

2.7.52.12.02.1.14

More vulnerabilities in mbed tls

See all →