CVE-2018-9989: High severity Arm mbed TLS vulnerability
Published Apr 10, 2018
·Updated
ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in sslparseserverpskhint() that could cause a crash on invalid input.
Affected Software
6 affected components
Arm mbed TLS<2.1.11
Arm mbed TLS>=2.7.0<2.7.2
Arm mbed TLS=2.8.0-rc1
Debian Debian Linux=8.0
Debian Debian Linux=9.0
TrustedFirmware Mbed Tls=2.8.0-rc1
Remediation
Event History
Apr 10, 2018
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
via NVD·07:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2018-9989?
CVE-2018-9989 is a vulnerability in ARM mbed TLS before version 2.1.11, before version 2.7.2, and before version 2.8.0 that could cause a crash on invalid input due to a buffer over-read in ssl_parse_server_psk_hint().
2
How severe is CVE-2018-9989?
CVE-2018-9989 has a severity value of 7.5, which is considered high.
3
What software versions are affected by CVE-2018-9989?
ARM mbed TLS versions before 2.1.11, before 2.7.2, and before 2.8.0 are affected by CVE-2018-9989.
4
How can I fix CVE-2018-9989?
To fix CVE-2018-9989, it is recommended to update ARM mbed TLS to version 2.1.11 or later.
5
Which CWE category does CVE-2018-9989 belong to?
CVE-2018-9989 belongs to CWE category 125, which is Buffer Over-read.