2 lines
4.0 KiB
JSON
2 lines
4.0 KiB
JSON
{"affected":[{"affectedData":[{"product":"ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14","vendor":"n/a","versions":[{"status":"affected","version":"ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14"}]}],"source":"security@debian.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*","matchCriteriaId":"71452E8B-F845-4575-8D58-7D6FE48759B8","versionEndExcluding":"2.1.14","vulnerable":true},{"criteria":"cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*","matchCriteriaId":"971334EF-0D28-4569-86F6-F69A22F01E0A","versionEndExcluding":"2.7.5","versionStartIncluding":"2.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*","matchCriteriaId":"4CFF4D8F-4789-4E5E-B741-C511FABFD5A4","versionEndExcluding":"2.12.0","versionStartIncluding":"2.8.0","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43","vulnerable":true},{"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows local users to achieve partial plaintext recovery (for a CBC based ciphersuite) via a cache-based side-channel attack."},{"lang":"es","value":"ARM mbed TLS en versiones anteriores a la 2.12.0, en versiones anteriores a la 2.7.5 y en versiones anteriores a la 2.1.14 permite a los usuarios locales lograr una recuperación parcial de texto plano (para un ciphersuite basado en CBC) mediante un ataque de canal lateral basado en caché."}],"id":"CVE-2018-0498","lastModified":"2026-06-17T01:30:59.247","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"LOW","cvssData":{"accessComplexity":"MEDIUM","accessVector":"LOCAL","authentication":"NONE","availabilityImpact":"NONE","baseScore":1.9,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:L/AC:M/Au:N/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":3.4,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.0"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-07-28T17:29:00.287","references":[{"source":"security@debian.org","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html"},{"source":"security@debian.org","tags":["Mitigation","Third Party Advisory"],"url":"https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02"},{"source":"security@debian.org","url":"https://usn.ubuntu.com/4267-1/"},{"source":"security@debian.org","tags":["Third Party Advisory"],"url":"https://www.debian.org/security/2018/dsa-4296"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"],"url":"https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://usn.ubuntu.com/4267-1/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://www.debian.org/security/2018/dsa-4296"}],"sourceIdentifier":"security@debian.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
|