CVE-2018-9988: High severity Arm mbed TLS vulnerability
ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in sslparseserverkeyexchange() that could cause a crash on invalid input.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-9988?
CVE-2018-9988 is a vulnerability in ARM mbed TLS before versions 2.1.11, 2.7.2, and 2.8.0 that could cause a crash on invalid input due to a buffer over-read in ssl_parse_server_key_exchange().
How severe is CVE-2018-9988?
CVE-2018-9988 has a severity score of 7.5 (high).
What software is affected by CVE-2018-9988?
ARM mbed TLS versions before 2.1.11, before 2.7.2, and before 2.8.0 are affected, as well as Debian Debian Linux 8.0 and 9.0.
How can CVE-2018-9988 be fixed?
To fix CVE-2018-9988, users should update to ARM mbed TLS version 2.1.11, 2.7.2, or 2.8.0, or apply the appropriate patches provided by the vendor.
Where can I find more information about CVE-2018-9988?
More information about CVE-2018-9988 can be found in the following references: [Link 1](https://github.com/ARMmbed/mbedtls/commit/027f84c69f4ef30c0693832a6c396ef19e563ca1), [Link 2](https://github.com/ARMmbed/mbedtls/commit/a1098f81c252b317ad34ea978aea2bc47760b215), [Link 3](https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html)