{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2017-2784 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2017-2784 is a high-severity memory corruption vulnerability in ARM mbed TLS, published on 20 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2017-2784 and fix it if it is affected.\n\nWhat it is: CVE-2017-2784 is a high-severity memory corruption vulnerability in ARM mbed TLS, published on 20 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2017-2784 in the wild and no public exploit code.\n\nAffected product: ARM mbed TLS. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2017-2784/ (Markdown: https://insights.sbomify.com/CVE-2017-2784/index.md)","id":"CVE-2017-2784","markdown":"https://insights.sbomify.com/CVE-2017-2784/index.md","name":"CVE-2017-2784","record":{"aliases":["ALPINE-CVE-2017-2784","DEBIAN-CVE-2017-2784","GHSA-5wj7-rhf5-hqx4","MGASA-2017-0094","UBUNTU-CVE-2017-2784","openSUSE-SU-2017:0790-1","openSUSE-SU-2017:0792-1"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"mbed TLS library","requires_auth":"none","summary":"A stack pointer invalid free in mbed TLS x509 parsing allows remote code execution via crafted certificates.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"talos","cpe":[{"product":"mbed_tls","vendor":"trustedfirmware"}],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"cwes":[{"id":"CWE-295","name":"Improper Certificate Validation"}],"description":"An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.","ecosystems":["SUSE:Package Hub 12"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Memory corruption in mbed TLS","id":"CVE-2017-2784","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2017"},"n_packages":2,"n_references":3,"next":{"headline":"Memory corruption in PopUp Printer Client","id":"CVE-2017-2785"},"packages":[{"ecosystem":"SUSE:Package Hub 12","fixed":["1.3.19-5.1"],"introduced":["0"],"last_affected":[],"package":"mbedtls","purl":"pkg:rpm/suse/mbedtls\u0026distro=SUSE%20Package%20Hub%2012","source":"openSUSE-SU-2017:0790-1"},{"ecosystem":"SUSE:Package Hub 12","fixed":["1.3.19-5.1"],"introduced":["0"],"last_affected":[],"package":"mbedtls","purl":"pkg:rpm/suse/mbedtls\u0026distro=SUSE%20Package%20Hub%2012","source":"openSUSE-SU-2017:0792-1"}],"prev":{"headline":"Memory corruption in DMC HTMLFilter","id":"CVE-2017-2783"},"products":["mbed TLS"],"published":"2017-04-20","related":[{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2026-34875","kev_date_added":null,"published":"2026-04-01"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2024-49195","kev_date_added":null,"published":"2024-10-15"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2024-45158","kev_date_added":null,"published":"2024-09-05"},{"cvss_score":9.8,"headline":"Auth bypass in n/a","id":"CVE-2024-45159","kev_date_added":null,"published":"2024-09-05"},{"cvss_score":9.8,"headline":"Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution.","id":"CVE-2023-45199","kev_date_added":null,"published":"2023-10-07"},{"cvss_score":9.1,"headline":"An issue was discovered in Mbed TLS 3.5.0 through 4.0.0.","id":"CVE-2026-34873","kev_date_added":null,"published":"2026-04-01"},{"cvss_score":9.1,"headline":"In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack","id":"CVE-2024-30166","kev_date_added":null,"published":"2024-04-03"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-05","vendors":["ARM"]},"summary":"A stack pointer invalid free in mbed TLS x509 parsing allows remote code execution via crafted certificates.","url":"https://insights.sbomify.com/CVE-2017-2784/"}