Critical Remote Code Execution Vulnerability in mbedtls Package
Summary
ALPINE-CVE-2018-0488: ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a craf... Affects mbedtls versions < 2.7.0-r0. Fixed in 2.7.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mbedtls package is a widely-used cryptographic library that provides secure communication protocols such as TLS and DTLS. It is designed to be lightweight and easy to integrate into various applications, making it popular among developers. However, certain versions of mbedtls are vulnerable to a critical security flaw that can lead to remote code execution, posing significant risks to applications relying on this library for secure communications.
Vulnerability Detail
ARM mbed TLS versions prior to 1.3.22, 2.1.10, and 2.7.0 are susceptible to a vulnerability that arises when the truncated HMAC extension and CBC mode are utilized. This flaw allows remote attackers to execute arbitrary code or cause a denial of service due to heap corruption via a specially crafted application packet within a TLS or DTLS session. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a critical risk level.
How To Fix
Minimum fixed version
2.7.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade mbedtlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing additional network security measures such as firewalls or intrusion detection systems to mitigate the risk of exploitation until the package can be updated.
Conclusion
The mbedtls package has a critical vulnerability that can lead to severe security risks if not addressed. It is crucial for developers and system administrators to update to the patched version 2.7.0-r0 to safeguard their applications. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for mbedtls →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical risk level.
Affected versions include mbedtls prior to 1.3.22, 2.1.10, and 2.7.0.
If your application is vulnerable, attackers could execute arbitrary code or cause a denial of service, compromising the security of your application.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for mbedtls.
