CVE-2017-18187 Integer overflow in n/a
An integer overflow in mbed TLS allows bypassing bounds checks during PSK identity parsing, potentially compromising TLS security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-18187?
CVE-2017-18187 is a critical vulnerability in Arm Mbed Tls, published on 14 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c.
Weakness: CWE-190
Which versions are affected by CVE-2017-18187?
It affects 2 products.
Products include Arm Mbed Tls, Debian Debian Linux.
How do I fix CVE-2017-18187?
Upgrade to a fixed version.
Is CVE-2017-18187 being exploited?
There is no known exploitation of CVE-2017-18187 in the wild and no public exploit code.
Other vulnerabilities in Arm Mbed Tls
- CVE-2026-34877 Deserialization in n/a
- CVE-2022-46393 Memory corruption in n/a
- CVE-2021-44732 Use after free in n/a
- CVE-2018-0487 Memory corruption in ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0
- CVE-2018-0488 Memory corruption in ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0
Sources
Also known as ALPINE-CVE-2017-18187, DEBIAN-CVE-2017-18187, GHSA-3g9w-ghrc-hc72, UBUNTU-CVE-2017-18187.