This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2018-0497 →
DEBIAN-CVE-2018-0497
ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recovery (for a CBC based ciphersuite...
Original description
The description as published by the source.
ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recovery (for a CBC based ciphersuite) via a timing-based side-channel attack. This vulnerability exists because of an incorrect fix (with a wrong SHA-384 calculation) for CVE-2013-0169.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
mbedtls
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1"}]}]
Debian:13
mbedtls
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1"}]}]
Debian:14
mbedtls
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1"}]}]
References
- advisory security-tracker.debian.org