Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2017-2784 (GCVE-0-2017-2784)
Vulnerability from cvelistv5
Published
2017-04-20 18:00
Modified
2024-08-05 14:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Stack pointer vulnerability
Summary
An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.
References
► | URL | Tags | |||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T14:02:07.676Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "GLSA-201706-18", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201706-18" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://www.talosintelligence.com/reports/TALOS-2017-0274/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "mbed TLS", "vendor": "ARM", "versions": [ { "status": "affected", "version": "2.4.0" } ] } ], "datePublic": "2017-03-11T00:00:00", "descriptions": [ { "lang": "en", "value": "An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications." } ], "metrics": [ { "cvssV3_0": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } } ], "problemTypes": [ { "descriptions": [ { "description": "Stack pointer vulnerability", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2022-04-19T18:22:05", "orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos" }, "references": [ { "name": "GLSA-201706-18", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/201706-18" }, { "tags": [ "x_refsource_MISC" ], "url": "http://www.talosintelligence.com/reports/TALOS-2017-0274/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "talos-cna@cisco.com", "ID": "CVE-2017-2784", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "mbed TLS", "version": { "version_data": [ { "version_value": "2.4.0" } ] } } ] }, "vendor_name": "ARM" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications." } ] }, "impact": { "cvss": { "baseScore": 8.1, "baseSeverity": "High", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Stack pointer vulnerability" } ] } ] }, "references": { "reference_data": [ { "name": "GLSA-201706-18", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201706-18" }, { "name": "http://www.talosintelligence.com/reports/TALOS-2017-0274/", "refsource": "MISC", "url": "http://www.talosintelligence.com/reports/TALOS-2017-0274/" }, { "name": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01", "refsource": "CONFIRM", "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01" } ] } } } }, "cveMetadata": { "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "assignerShortName": "talos", "cveId": "CVE-2017-2784", "datePublished": "2017-04-20T18:00:00", "dateReserved": "2016-12-01T00:00:00", "dateUpdated": "2024-08-05T14:02:07.676Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2017-2784\",\"sourceIdentifier\":\"talos-cna@cisco.com\",\"published\":\"2017-04-20T18:59:01.593\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.\"},{\"lang\":\"es\",\"value\":\"Existe una vulnerabilidad explotable libre de un apuntador de pila en el c\u00f3digo de an\u00e1lisis de certificado x509 de ARM mbed TLS en versiones anteriores a 1.3.19, 2.x en versiones anteriores a 2.1.7 y 2.4.x en versiones anteriores a 2.4.2. Un certificado x509 especialmente manipulado, cuando se analiza por la biblioteca TLS mbed, puede provocar un inv\u00e1lido libre de un puntero de pila que conduce a una posible ejecuci\u00f3n de c\u00f3digo remoto. Para aprovechar esta vulnerabilidad, un atacante puede actuar como un cliente o un servidor en una red para entregar certificados maliciosos x509 a aplicaciones vulnerables.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"talos-cna@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.3.18\",\"matchCriteriaId\":\"D05A56CA-13ED-4619-82DE-B8727B0DD300\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B395D81-876F-43FC-8DB9-44377647A37A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F92622F1-82DA-4819-8275-06DC9DBE1BA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5871FDE9-02D0-466C-BDB7-90A14C4F637E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE6B4875-3FC3-499F-A76B-2D04982F743A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3B67842-5AFA-459F-9CCF-772B9DC7139F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD0500EE-52C0-4896-B3D8-5BE731D66039\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"015739E9-C0E3-4A62-BB9D-FA836BFD4351\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"842B0D15-6A3D-4CEE-AD02-49B0436E78E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arm:mbed_tls:2.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"525190A3-2194-4E4E-9D34-0048583B9C42\"}]}]}],\"references\":[{\"url\":\"http://www.talosintelligence.com/reports/TALOS-2017-0274/\",\"source\":\"talos-cna@cisco.com\",\"tags\":[\"Exploit\",\"Technical Description\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://security.gentoo.org/glsa/201706-18\",\"source\":\"talos-cna@cisco.com\"},{\"url\":\"https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01\",\"source\":\"talos-cna@cisco.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"http://www.talosintelligence.com/reports/TALOS-2017-0274/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Technical Description\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://security.gentoo.org/glsa/201706-18\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}" } }
opensuse-su-2024:11043-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
libmbedcrypto7-2.27.0-1.2 on GA media
Notes
Title of the patch
libmbedcrypto7-2.27.0-1.2 on GA media
Description of the patch
These are all security issues fixed in the libmbedcrypto7-2.27.0-1.2 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-11043
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "libmbedcrypto7-2.27.0-1.2 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the libmbedcrypto7-2.27.0-1.2 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-11043", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11043-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2017-14032 page", "url": "https://www.suse.com/security/cve/CVE-2017-14032/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-2784 page", "url": "https://www.suse.com/security/cve/CVE-2017-2784/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-0487 page", "url": "https://www.suse.com/security/cve/CVE-2018-0487/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-0488 page", "url": "https://www.suse.com/security/cve/CVE-2018-0488/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-19608 page", "url": "https://www.suse.com/security/cve/CVE-2018-19608/" } ], "title": "libmbedcrypto7-2.27.0-1.2 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:11043-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "libmbedcrypto7-2.27.0-1.2.aarch64", "product": { "name": "libmbedcrypto7-2.27.0-1.2.aarch64", "product_id": "libmbedcrypto7-2.27.0-1.2.aarch64" } }, { "category": "product_version", "name": "libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "product": { "name": "libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "product_id": "libmbedcrypto7-32bit-2.27.0-1.2.aarch64" } }, { "category": "product_version", "name": "libmbedtls13-2.27.0-1.2.aarch64", "product": { "name": "libmbedtls13-2.27.0-1.2.aarch64", "product_id": "libmbedtls13-2.27.0-1.2.aarch64" } }, { "category": "product_version", "name": "libmbedtls13-32bit-2.27.0-1.2.aarch64", "product": { "name": "libmbedtls13-32bit-2.27.0-1.2.aarch64", "product_id": "libmbedtls13-32bit-2.27.0-1.2.aarch64" } }, { "category": "product_version", "name": "libmbedx509-1-2.27.0-1.2.aarch64", "product": { "name": "libmbedx509-1-2.27.0-1.2.aarch64", "product_id": "libmbedx509-1-2.27.0-1.2.aarch64" } }, { "category": "product_version", "name": "libmbedx509-1-32bit-2.27.0-1.2.aarch64", "product": { "name": "libmbedx509-1-32bit-2.27.0-1.2.aarch64", "product_id": "libmbedx509-1-32bit-2.27.0-1.2.aarch64" } }, { "category": "product_version", "name": "mbedtls-devel-2.27.0-1.2.aarch64", "product": { "name": "mbedtls-devel-2.27.0-1.2.aarch64", "product_id": "mbedtls-devel-2.27.0-1.2.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libmbedcrypto7-2.27.0-1.2.ppc64le", "product": { "name": "libmbedcrypto7-2.27.0-1.2.ppc64le", "product_id": "libmbedcrypto7-2.27.0-1.2.ppc64le" } }, { "category": "product_version", "name": "libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "product": { "name": "libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "product_id": "libmbedcrypto7-32bit-2.27.0-1.2.ppc64le" } }, { "category": "product_version", "name": "libmbedtls13-2.27.0-1.2.ppc64le", "product": { "name": "libmbedtls13-2.27.0-1.2.ppc64le", "product_id": "libmbedtls13-2.27.0-1.2.ppc64le" } }, { "category": "product_version", "name": "libmbedtls13-32bit-2.27.0-1.2.ppc64le", "product": { "name": "libmbedtls13-32bit-2.27.0-1.2.ppc64le", "product_id": "libmbedtls13-32bit-2.27.0-1.2.ppc64le" } }, { "category": "product_version", "name": "libmbedx509-1-2.27.0-1.2.ppc64le", "product": { "name": "libmbedx509-1-2.27.0-1.2.ppc64le", "product_id": "libmbedx509-1-2.27.0-1.2.ppc64le" } }, { "category": "product_version", "name": "libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "product": { "name": "libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "product_id": "libmbedx509-1-32bit-2.27.0-1.2.ppc64le" } }, { "category": "product_version", "name": "mbedtls-devel-2.27.0-1.2.ppc64le", "product": { "name": "mbedtls-devel-2.27.0-1.2.ppc64le", "product_id": "mbedtls-devel-2.27.0-1.2.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libmbedcrypto7-2.27.0-1.2.s390x", "product": { "name": "libmbedcrypto7-2.27.0-1.2.s390x", "product_id": "libmbedcrypto7-2.27.0-1.2.s390x" } }, { "category": "product_version", "name": "libmbedcrypto7-32bit-2.27.0-1.2.s390x", "product": { "name": "libmbedcrypto7-32bit-2.27.0-1.2.s390x", "product_id": "libmbedcrypto7-32bit-2.27.0-1.2.s390x" } }, { "category": "product_version", "name": "libmbedtls13-2.27.0-1.2.s390x", "product": { "name": "libmbedtls13-2.27.0-1.2.s390x", "product_id": "libmbedtls13-2.27.0-1.2.s390x" } }, { "category": "product_version", "name": "libmbedtls13-32bit-2.27.0-1.2.s390x", "product": { "name": "libmbedtls13-32bit-2.27.0-1.2.s390x", "product_id": "libmbedtls13-32bit-2.27.0-1.2.s390x" } }, { "category": "product_version", "name": "libmbedx509-1-2.27.0-1.2.s390x", "product": { "name": "libmbedx509-1-2.27.0-1.2.s390x", "product_id": "libmbedx509-1-2.27.0-1.2.s390x" } }, { "category": "product_version", "name": "libmbedx509-1-32bit-2.27.0-1.2.s390x", "product": { "name": "libmbedx509-1-32bit-2.27.0-1.2.s390x", "product_id": "libmbedx509-1-32bit-2.27.0-1.2.s390x" } }, { "category": "product_version", "name": "mbedtls-devel-2.27.0-1.2.s390x", "product": { "name": "mbedtls-devel-2.27.0-1.2.s390x", "product_id": "mbedtls-devel-2.27.0-1.2.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "libmbedcrypto7-2.27.0-1.2.x86_64", "product": { "name": "libmbedcrypto7-2.27.0-1.2.x86_64", "product_id": "libmbedcrypto7-2.27.0-1.2.x86_64" } }, { "category": "product_version", "name": "libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "product": { "name": "libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "product_id": "libmbedcrypto7-32bit-2.27.0-1.2.x86_64" } }, { "category": "product_version", "name": "libmbedtls13-2.27.0-1.2.x86_64", "product": { "name": "libmbedtls13-2.27.0-1.2.x86_64", "product_id": "libmbedtls13-2.27.0-1.2.x86_64" } }, { "category": "product_version", "name": "libmbedtls13-32bit-2.27.0-1.2.x86_64", "product": { "name": "libmbedtls13-32bit-2.27.0-1.2.x86_64", "product_id": "libmbedtls13-32bit-2.27.0-1.2.x86_64" } }, { "category": "product_version", "name": "libmbedx509-1-2.27.0-1.2.x86_64", "product": { "name": "libmbedx509-1-2.27.0-1.2.x86_64", "product_id": "libmbedx509-1-2.27.0-1.2.x86_64" } }, { "category": "product_version", "name": "libmbedx509-1-32bit-2.27.0-1.2.x86_64", "product": { "name": "libmbedx509-1-32bit-2.27.0-1.2.x86_64", "product_id": "libmbedx509-1-32bit-2.27.0-1.2.x86_64" } }, { "category": "product_version", "name": "mbedtls-devel-2.27.0-1.2.x86_64", "product": { "name": "mbedtls-devel-2.27.0-1.2.x86_64", "product_id": "mbedtls-devel-2.27.0-1.2.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libmbedcrypto7-2.27.0-1.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64" }, "product_reference": "libmbedcrypto7-2.27.0-1.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedcrypto7-2.27.0-1.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le" }, "product_reference": "libmbedcrypto7-2.27.0-1.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedcrypto7-2.27.0-1.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x" }, "product_reference": "libmbedcrypto7-2.27.0-1.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedcrypto7-2.27.0-1.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64" }, "product_reference": "libmbedcrypto7-2.27.0-1.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedcrypto7-32bit-2.27.0-1.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64" }, "product_reference": "libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedcrypto7-32bit-2.27.0-1.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le" }, "product_reference": "libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedcrypto7-32bit-2.27.0-1.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x" }, "product_reference": "libmbedcrypto7-32bit-2.27.0-1.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedcrypto7-32bit-2.27.0-1.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64" }, "product_reference": "libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls13-2.27.0-1.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64" }, "product_reference": "libmbedtls13-2.27.0-1.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls13-2.27.0-1.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le" }, "product_reference": "libmbedtls13-2.27.0-1.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls13-2.27.0-1.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x" }, "product_reference": "libmbedtls13-2.27.0-1.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls13-2.27.0-1.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64" }, "product_reference": "libmbedtls13-2.27.0-1.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls13-32bit-2.27.0-1.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64" }, "product_reference": "libmbedtls13-32bit-2.27.0-1.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls13-32bit-2.27.0-1.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le" }, "product_reference": "libmbedtls13-32bit-2.27.0-1.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls13-32bit-2.27.0-1.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x" }, "product_reference": "libmbedtls13-32bit-2.27.0-1.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls13-32bit-2.27.0-1.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64" }, "product_reference": "libmbedtls13-32bit-2.27.0-1.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedx509-1-2.27.0-1.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64" }, "product_reference": "libmbedx509-1-2.27.0-1.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedx509-1-2.27.0-1.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le" }, "product_reference": "libmbedx509-1-2.27.0-1.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedx509-1-2.27.0-1.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x" }, "product_reference": "libmbedx509-1-2.27.0-1.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedx509-1-2.27.0-1.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64" }, "product_reference": "libmbedx509-1-2.27.0-1.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedx509-1-32bit-2.27.0-1.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64" }, "product_reference": "libmbedx509-1-32bit-2.27.0-1.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedx509-1-32bit-2.27.0-1.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le" }, "product_reference": "libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedx509-1-32bit-2.27.0-1.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x" }, "product_reference": "libmbedx509-1-32bit-2.27.0-1.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedx509-1-32bit-2.27.0-1.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64" }, "product_reference": "libmbedx509-1-32bit-2.27.0-1.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "mbedtls-devel-2.27.0-1.2.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64" }, "product_reference": "mbedtls-devel-2.27.0-1.2.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "mbedtls-devel-2.27.0-1.2.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le" }, "product_reference": "mbedtls-devel-2.27.0-1.2.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "mbedtls-devel-2.27.0-1.2.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x" }, "product_reference": "mbedtls-devel-2.27.0-1.2.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "mbedtls-devel-2.27.0-1.2.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" }, "product_reference": "mbedtls-devel-2.27.0-1.2.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-14032", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-14032" } ], "notes": [ { "category": "general", "text": "ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-14032", "url": "https://www.suse.com/security/cve/CVE-2017-14032" }, { "category": "external", "summary": "SUSE Bug 1056544 for CVE-2017-14032", "url": "https://bugzilla.suse.com/1056544" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2017-14032" }, { "cve": "CVE-2017-2784", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-2784" } ], "notes": [ { "category": "general", "text": "An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-2784", "url": "https://www.suse.com/security/cve/CVE-2017-2784" }, { "category": "external", "summary": "SUSE Bug 1029017 for CVE-2017-2784", "url": "https://bugzilla.suse.com/1029017" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2017-2784" }, { "cve": "CVE-2018-0487", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-0487" } ], "notes": [ { "category": "general", "text": "ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-0487", "url": "https://www.suse.com/security/cve/CVE-2018-0487" }, { "category": "external", "summary": "SUSE Bug 1080826 for CVE-2018-0487", "url": "https://bugzilla.suse.com/1080826" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2018-0487" }, { "cve": "CVE-2018-0488", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-0488" } ], "notes": [ { "category": "general", "text": "ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-0488", "url": "https://www.suse.com/security/cve/CVE-2018-0488" }, { "category": "external", "summary": "SUSE Bug 1080828 for CVE-2018-0488", "url": "https://bugzilla.suse.com/1080828" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2018-0488" }, { "cve": "CVE-2018-19608", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-19608" } ], "notes": [ { "category": "general", "text": "Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption, which is used in RSA-without-(EC)DH(E) cipher suites.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-19608", "url": "https://www.suse.com/security/cve/CVE-2018-19608" }, { "category": "external", "summary": "SUSE Bug 1118727 for CVE-2018-19608", "url": "https://bugzilla.suse.com/1118727" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedcrypto7-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedtls13-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.s390x", "openSUSE Tumbleweed:libmbedx509-1-32bit-2.27.0-1.2.x86_64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.aarch64", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.ppc64le", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.s390x", "openSUSE Tumbleweed:mbedtls-devel-2.27.0-1.2.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-19608" } ] }
opensuse-su-2017:0792-1
Vulnerability from csaf_opensuse
Published
2017-03-22 10:02
Modified
2017-03-22 10:02
Summary
Security update for mbedtls
Notes
Title of the patch
Security update for mbedtls
Description of the patch
This update to mbedtls 1.3.19 fixes security issues and bugs.
The following vulnerability was fixed:
CVE-2017-2784: A remote user could have used a specially crafted certificate to cause
mbedtls to free a buffer allocated on the stack when verifying the validity
of public key with a secp224k1 curve, which could have allowed remote
code execution on some platforms (boo#1029017)
The following non-security changes are included:
- Add checks to prevent signature forgeries for very large messages while using RSA through
the PK module in 64-bit systems.
- Fixed potential livelock during the parsing of a CRL in PEM format
Patchnames
openSUSE-2017-372
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for mbedtls", "title": "Title of the patch" }, { "category": "description", "text": "This update to mbedtls 1.3.19 fixes security issues and bugs.\n\nThe following vulnerability was fixed:\n\nCVE-2017-2784: A remote user could have used a specially crafted certificate to cause\n mbedtls to free a buffer allocated on the stack when verifying the validity\n of public key with a secp224k1 curve, which could have allowed remote\n code execution on some platforms (boo#1029017)\n\nThe following non-security changes are included:\n\n- Add checks to prevent signature forgeries for very large messages while using RSA through\n the PK module in 64-bit systems.\n- Fixed potential livelock during the parsing of a CRL in PEM format\n", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-2017-372", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2017_0792-1.json" }, { "category": "self", "summary": "URL for openSUSE-SU-2017:0792-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FAMN75AB4YE4LABPQEYS2NAM6F32VCFZ/#FAMN75AB4YE4LABPQEYS2NAM6F32VCFZ" }, { "category": "self", "summary": "E-Mail link for openSUSE-SU-2017:0792-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FAMN75AB4YE4LABPQEYS2NAM6F32VCFZ/#FAMN75AB4YE4LABPQEYS2NAM6F32VCFZ" }, { "category": "self", "summary": "SUSE Bug 1029017", "url": "https://bugzilla.suse.com/1029017" }, { "category": "self", "summary": "SUSE CVE CVE-2017-2784 page", "url": "https://www.suse.com/security/cve/CVE-2017-2784/" } ], "title": "Security update for mbedtls", "tracking": { "current_release_date": "2017-03-22T10:02:23Z", "generator": { "date": "2017-03-22T10:02:23Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2017:0792-1", "initial_release_date": "2017-03-22T10:02:23Z", "revision_history": [ { "date": "2017-03-22T10:02:23Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "libmbedtls9-1.3.19-5.1.aarch64", "product": { "name": "libmbedtls9-1.3.19-5.1.aarch64", "product_id": "libmbedtls9-1.3.19-5.1.aarch64" } }, { "category": "product_version", "name": "mbedtls-devel-1.3.19-5.1.aarch64", "product": { "name": "mbedtls-devel-1.3.19-5.1.aarch64", "product_id": "mbedtls-devel-1.3.19-5.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libmbedtls9-1.3.19-5.1.ppc64le", "product": { "name": "libmbedtls9-1.3.19-5.1.ppc64le", "product_id": "libmbedtls9-1.3.19-5.1.ppc64le" } }, { "category": "product_version", "name": "mbedtls-devel-1.3.19-5.1.ppc64le", "product": { "name": "mbedtls-devel-1.3.19-5.1.ppc64le", "product_id": "mbedtls-devel-1.3.19-5.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libmbedtls9-1.3.19-5.1.s390x", "product": { "name": "libmbedtls9-1.3.19-5.1.s390x", "product_id": "libmbedtls9-1.3.19-5.1.s390x" } }, { "category": "product_version", "name": "mbedtls-devel-1.3.19-5.1.s390x", "product": { "name": "mbedtls-devel-1.3.19-5.1.s390x", "product_id": "mbedtls-devel-1.3.19-5.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "libmbedtls9-1.3.19-5.1.x86_64", "product": { "name": "libmbedtls9-1.3.19-5.1.x86_64", "product_id": "libmbedtls9-1.3.19-5.1.x86_64" } }, { "category": "product_version", "name": "mbedtls-devel-1.3.19-5.1.x86_64", "product": { "name": "mbedtls-devel-1.3.19-5.1.x86_64", "product_id": "mbedtls-devel-1.3.19-5.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Package Hub 12", "product": { "name": "SUSE Package Hub 12", "product_id": "SUSE Package Hub 12", "product_identification_helper": { "cpe": "cpe:/o:suse:packagehub:12" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libmbedtls9-1.3.19-5.1.aarch64 as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.aarch64" }, "product_reference": "libmbedtls9-1.3.19-5.1.aarch64", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls9-1.3.19-5.1.ppc64le as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.ppc64le" }, "product_reference": "libmbedtls9-1.3.19-5.1.ppc64le", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls9-1.3.19-5.1.s390x as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.s390x" }, "product_reference": "libmbedtls9-1.3.19-5.1.s390x", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls9-1.3.19-5.1.x86_64 as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.x86_64" }, "product_reference": "libmbedtls9-1.3.19-5.1.x86_64", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "mbedtls-devel-1.3.19-5.1.aarch64 as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.aarch64" }, "product_reference": "mbedtls-devel-1.3.19-5.1.aarch64", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "mbedtls-devel-1.3.19-5.1.ppc64le as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.ppc64le" }, "product_reference": "mbedtls-devel-1.3.19-5.1.ppc64le", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "mbedtls-devel-1.3.19-5.1.s390x as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.s390x" }, "product_reference": "mbedtls-devel-1.3.19-5.1.s390x", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "mbedtls-devel-1.3.19-5.1.x86_64 as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.x86_64" }, "product_reference": "mbedtls-devel-1.3.19-5.1.x86_64", "relates_to_product_reference": "SUSE Package Hub 12" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-2784", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-2784" } ], "notes": [ { "category": "general", "text": "An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.aarch64", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.ppc64le", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.s390x", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.x86_64", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.aarch64", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.ppc64le", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.s390x", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-2784", "url": "https://www.suse.com/security/cve/CVE-2017-2784" }, { "category": "external", "summary": "SUSE Bug 1029017 for CVE-2017-2784", "url": "https://bugzilla.suse.com/1029017" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.aarch64", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.ppc64le", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.s390x", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.x86_64", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.aarch64", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.ppc64le", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.s390x", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.aarch64", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.ppc64le", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.s390x", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.x86_64", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.aarch64", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.ppc64le", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.s390x", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2017-03-22T10:02:23Z", "details": "important" } ], "title": "CVE-2017-2784" } ] }
opensuse-su-2017:0790-1
Vulnerability from csaf_opensuse
Published
2017-03-22 10:02
Modified
2017-03-22 10:02
Summary
Security update for mbedtls
Notes
Title of the patch
Security update for mbedtls
Description of the patch
This update to mbedtls 1.3.19 fixes security issues and bugs.
The following vulnerability was fixed:
CVE-2017-2784: A remote user could have used a specially crafted certificate to cause
mbedtls to free a buffer allocated on the stack when verifying the validity
of public key with a secp224k1 curve, which could have allowed remote
code execution on some platforms (boo#1029017)
The following non-security changes are included:
- Add checks to prevent signature forgeries for very large messages while using RSA through
the PK module in 64-bit systems.
- Fixed potential livelock during the parsing of a CRL in PEM format
Patchnames
openSUSE-2017-372
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for mbedtls", "title": "Title of the patch" }, { "category": "description", "text": "This update to mbedtls 1.3.19 fixes security issues and bugs.\n\nThe following vulnerability was fixed:\n\nCVE-2017-2784: A remote user could have used a specially crafted certificate to cause\n mbedtls to free a buffer allocated on the stack when verifying the validity\n of public key with a secp224k1 curve, which could have allowed remote\n code execution on some platforms (boo#1029017)\n\nThe following non-security changes are included:\n\n- Add checks to prevent signature forgeries for very large messages while using RSA through\n the PK module in 64-bit systems.\n- Fixed potential livelock during the parsing of a CRL in PEM format\n", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-2017-372", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2017_0790-1.json" }, { "category": "self", "summary": "URL for openSUSE-SU-2017:0790-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WRIPVQ2ATMWAEIYYJETVM2L3IO7IWKFA/#WRIPVQ2ATMWAEIYYJETVM2L3IO7IWKFA" }, { "category": "self", "summary": "E-Mail link for openSUSE-SU-2017:0790-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WRIPVQ2ATMWAEIYYJETVM2L3IO7IWKFA/#WRIPVQ2ATMWAEIYYJETVM2L3IO7IWKFA" }, { "category": "self", "summary": "SUSE Bug 1029017", "url": "https://bugzilla.suse.com/1029017" }, { "category": "self", "summary": "SUSE CVE CVE-2017-2784 page", "url": "https://www.suse.com/security/cve/CVE-2017-2784/" } ], "title": "Security update for mbedtls", "tracking": { "current_release_date": "2017-03-22T10:02:23Z", "generator": { "date": "2017-03-22T10:02:23Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2017:0790-1", "initial_release_date": "2017-03-22T10:02:23Z", "revision_history": [ { "date": "2017-03-22T10:02:23Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "libmbedtls9-1.3.19-5.1.aarch64", "product": { "name": "libmbedtls9-1.3.19-5.1.aarch64", "product_id": "libmbedtls9-1.3.19-5.1.aarch64" } }, { "category": "product_version", "name": "mbedtls-devel-1.3.19-5.1.aarch64", "product": { "name": "mbedtls-devel-1.3.19-5.1.aarch64", "product_id": "mbedtls-devel-1.3.19-5.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libmbedtls9-1.3.19-5.1.ppc64le", "product": { "name": "libmbedtls9-1.3.19-5.1.ppc64le", "product_id": "libmbedtls9-1.3.19-5.1.ppc64le" } }, { "category": "product_version", "name": "mbedtls-devel-1.3.19-5.1.ppc64le", "product": { "name": "mbedtls-devel-1.3.19-5.1.ppc64le", "product_id": "mbedtls-devel-1.3.19-5.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libmbedtls9-1.3.19-5.1.s390x", "product": { "name": "libmbedtls9-1.3.19-5.1.s390x", "product_id": "libmbedtls9-1.3.19-5.1.s390x" } }, { "category": "product_version", "name": "mbedtls-devel-1.3.19-5.1.s390x", "product": { "name": "mbedtls-devel-1.3.19-5.1.s390x", "product_id": "mbedtls-devel-1.3.19-5.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "libmbedtls9-1.3.19-5.1.x86_64", "product": { "name": "libmbedtls9-1.3.19-5.1.x86_64", "product_id": "libmbedtls9-1.3.19-5.1.x86_64" } }, { "category": "product_version", "name": "mbedtls-devel-1.3.19-5.1.x86_64", "product": { "name": "mbedtls-devel-1.3.19-5.1.x86_64", "product_id": "mbedtls-devel-1.3.19-5.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Package Hub 12", "product": { "name": "SUSE Package Hub 12", "product_id": "SUSE Package Hub 12", "product_identification_helper": { "cpe": "cpe:/o:suse:packagehub:12" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libmbedtls9-1.3.19-5.1.aarch64 as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.aarch64" }, "product_reference": "libmbedtls9-1.3.19-5.1.aarch64", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls9-1.3.19-5.1.ppc64le as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.ppc64le" }, "product_reference": "libmbedtls9-1.3.19-5.1.ppc64le", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls9-1.3.19-5.1.s390x as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.s390x" }, "product_reference": "libmbedtls9-1.3.19-5.1.s390x", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "libmbedtls9-1.3.19-5.1.x86_64 as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.x86_64" }, "product_reference": "libmbedtls9-1.3.19-5.1.x86_64", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "mbedtls-devel-1.3.19-5.1.aarch64 as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.aarch64" }, "product_reference": "mbedtls-devel-1.3.19-5.1.aarch64", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "mbedtls-devel-1.3.19-5.1.ppc64le as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.ppc64le" }, "product_reference": "mbedtls-devel-1.3.19-5.1.ppc64le", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "mbedtls-devel-1.3.19-5.1.s390x as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.s390x" }, "product_reference": "mbedtls-devel-1.3.19-5.1.s390x", "relates_to_product_reference": "SUSE Package Hub 12" }, { "category": "default_component_of", "full_product_name": { "name": "mbedtls-devel-1.3.19-5.1.x86_64 as component of SUSE Package Hub 12", "product_id": "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.x86_64" }, "product_reference": "mbedtls-devel-1.3.19-5.1.x86_64", "relates_to_product_reference": "SUSE Package Hub 12" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-2784", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-2784" } ], "notes": [ { "category": "general", "text": "An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.aarch64", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.ppc64le", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.s390x", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.x86_64", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.aarch64", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.ppc64le", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.s390x", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-2784", "url": "https://www.suse.com/security/cve/CVE-2017-2784" }, { "category": "external", "summary": "SUSE Bug 1029017 for CVE-2017-2784", "url": "https://bugzilla.suse.com/1029017" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.aarch64", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.ppc64le", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.s390x", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.x86_64", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.aarch64", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.ppc64le", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.s390x", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.aarch64", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.ppc64le", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.s390x", "SUSE Package Hub 12:libmbedtls9-1.3.19-5.1.x86_64", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.aarch64", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.ppc64le", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.s390x", "SUSE Package Hub 12:mbedtls-devel-1.3.19-5.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2017-03-22T10:02:23Z", "details": "important" } ], "title": "CVE-2017-2784" } ] }
fkie_cve-2017-2784
Vulnerability from fkie_nvd
Published
2017-04-20 18:59
Modified
2025-04-20 01:37
Severity ?
8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.
References
▶ | URL | Tags | |
---|---|---|---|
talos-cna@cisco.com | http://www.talosintelligence.com/reports/TALOS-2017-0274/ | Exploit, Technical Description, Third Party Advisory, VDB Entry | |
talos-cna@cisco.com | https://security.gentoo.org/glsa/201706-18 | ||
talos-cna@cisco.com | https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01 | Mitigation, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.talosintelligence.com/reports/TALOS-2017-0274/ | Exploit, Technical Description, Third Party Advisory, VDB Entry | |
af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201706-18 | ||
af854a3a-2127-422b-91ae-364da2661108 | https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01 | Mitigation, Vendor Advisory |
Impacted products
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*", "matchCriteriaId": "D05A56CA-13ED-4619-82DE-B8727B0DD300", "versionEndIncluding": "1.3.18", "vulnerable": true }, { "criteria": "cpe:2.3:a:arm:mbed_tls:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0B395D81-876F-43FC-8DB9-44377647A37A", "vulnerable": true }, { "criteria": "cpe:2.3:a:arm:mbed_tls:2.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "F92622F1-82DA-4819-8275-06DC9DBE1BA1", "vulnerable": true }, { "criteria": "cpe:2.3:a:arm:mbed_tls:2.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "5871FDE9-02D0-466C-BDB7-90A14C4F637E", "vulnerable": true }, { "criteria": "cpe:2.3:a:arm:mbed_tls:2.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "FE6B4875-3FC3-499F-A76B-2D04982F743A", "vulnerable": true }, { "criteria": "cpe:2.3:a:arm:mbed_tls:2.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "B3B67842-5AFA-459F-9CCF-772B9DC7139F", "vulnerable": true }, { "criteria": "cpe:2.3:a:arm:mbed_tls:2.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "AD0500EE-52C0-4896-B3D8-5BE731D66039", "vulnerable": true }, { "criteria": "cpe:2.3:a:arm:mbed_tls:2.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "015739E9-C0E3-4A62-BB9D-FA836BFD4351", "vulnerable": true }, { "criteria": "cpe:2.3:a:arm:mbed_tls:2.1.6:*:*:*:*:*:*:*", "matchCriteriaId": "842B0D15-6A3D-4CEE-AD02-49B0436E78E4", "vulnerable": true }, { "criteria": "cpe:2.3:a:arm:mbed_tls:2.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "525190A3-2194-4E4E-9D34-0048583B9C42", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications." }, { "lang": "es", "value": "Existe una vulnerabilidad explotable libre de un apuntador de pila en el c\u00f3digo de an\u00e1lisis de certificado x509 de ARM mbed TLS en versiones anteriores a 1.3.19, 2.x en versiones anteriores a 2.1.7 y 2.4.x en versiones anteriores a 2.4.2. Un certificado x509 especialmente manipulado, cuando se analiza por la biblioteca TLS mbed, puede provocar un inv\u00e1lido libre de un puntero de pila que conduce a una posible ejecuci\u00f3n de c\u00f3digo remoto. Para aprovechar esta vulnerabilidad, un atacante puede actuar como un cliente o un servidor en una red para entregar certificados maliciosos x509 a aplicaciones vulnerables." } ], "id": "CVE-2017-2784", "lastModified": "2025-04-20T01:37:25.860", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ], "cvssMetricV30": [ { "cvssData": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "talos-cna@cisco.com", "type": "Secondary" }, { "cvssData": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2017-04-20T18:59:01.593", "references": [ { "source": "talos-cna@cisco.com", "tags": [ "Exploit", "Technical Description", "Third Party Advisory", "VDB Entry" ], "url": "http://www.talosintelligence.com/reports/TALOS-2017-0274/" }, { "source": "talos-cna@cisco.com", "url": "https://security.gentoo.org/glsa/201706-18" }, { "source": "talos-cna@cisco.com", "tags": [ "Mitigation", "Vendor Advisory" ], "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Technical Description", "Third Party Advisory", "VDB Entry" ], "url": "http://www.talosintelligence.com/reports/TALOS-2017-0274/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201706-18" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mitigation", "Vendor Advisory" ], "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01" } ], "sourceIdentifier": "talos-cna@cisco.com", "vulnStatus": "Deferred", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-295" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
gsd-2017-2784
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2017-2784", "description": "An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.", "id": "GSD-2017-2784", "references": [ "https://www.suse.com/security/cve/CVE-2017-2784.html", "https://advisories.mageia.org/CVE-2017-2784.html", "https://security.archlinux.org/CVE-2017-2784" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2017-2784" ], "details": "An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.", "id": "GSD-2017-2784", "modified": "2023-12-13T01:21:05.281905Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "talos-cna@cisco.com", "ID": "CVE-2017-2784", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "mbed TLS", "version": { "version_data": [ { "version_value": "2.4.0" } ] } } ] }, "vendor_name": "ARM" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications." } ] }, "impact": { "cvss": { "baseScore": 8.1, "baseSeverity": "High", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Stack pointer vulnerability" } ] } ] }, "references": { "reference_data": [ { "name": "GLSA-201706-18", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201706-18" }, { "name": "http://www.talosintelligence.com/reports/TALOS-2017-0274/", "refsource": "MISC", "url": "http://www.talosintelligence.com/reports/TALOS-2017-0274/" }, { "name": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01", "refsource": "CONFIRM", "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:arm:mbed_tls:2.1.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:arm:mbed_tls:2.1.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:arm:mbed_tls:2.1.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:arm:mbed_tls:2.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:arm:mbed_tls:2.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:arm:mbed_tls:2.4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:arm:mbed_tls:2.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "1.3.18", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:arm:mbed_tls:2.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:arm:mbed_tls:2.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "talos-cna@cisco.com", "ID": "CVE-2017-2784" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-295" } ] } ] }, "references": { "reference_data": [ { "name": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01", "refsource": "CONFIRM", "tags": [ "Mitigation", "Vendor Advisory" ], "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01" }, { "name": "http://www.talosintelligence.com/reports/TALOS-2017-0274/", "refsource": "MISC", "tags": [ "Exploit", "Technical Description", "Third Party Advisory", "VDB Entry" ], "url": "http://www.talosintelligence.com/reports/TALOS-2017-0274/" }, { "name": "GLSA-201706-18", "refsource": "GENTOO", "tags": [], "url": "https://security.gentoo.org/glsa/201706-18" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "exploitabilityScore": 2.2, "impactScore": 5.9 } }, "lastModifiedDate": "2022-04-19T19:15Z", "publishedDate": "2017-04-20T18:59Z" } } }
ghsa-5wj7-rhf5-hqx4
Vulnerability from github
Published
2022-05-13 01:01
Modified
2025-04-20 03:36
Severity ?
VLAI Severity ?
Details
An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.
{ "affected": [], "aliases": [ "CVE-2017-2784" ], "database_specific": { "cwe_ids": [ "CWE-295" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2017-04-20T18:59:00Z", "severity": "HIGH" }, "details": "An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.", "id": "GHSA-5wj7-rhf5-hqx4", "modified": "2025-04-20T03:36:21Z", "published": "2022-05-13T01:01:28Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2784" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/201706-18" }, { "type": "WEB", "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01" }, { "type": "WEB", "url": "http://www.talosintelligence.com/reports/TALOS-2017-0274" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…