CVE-2017-12818 Denial of service in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE

High 7.5 Published 3 Oct 2017 Updated 16 Sep 2024

A stack overflow in the custom XML parser allows remote attackers to cause a denial of service in Sentinel LDK products.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-12818?

CVE-2017-12818 is a high-severity denial of service vulnerability in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE, published on 3 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Stack overflow in custom XML-parser in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denial of service.

Weakness: CWE-119

Which versions are affected by CVE-2017-12818?

It affects 1 product.

Products include Sentinel Sentinel Ldk Rte Firmware.

How do I fix CVE-2017-12818?

No fix has been published for CVE-2017-12818 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-12818 being exploited?

There is no known exploitation of CVE-2017-12818 in the wild and no public exploit code.

Sources

Also known as GHSA-wmpg-v67v-chwf.