CVE-2018-4398 Weak cryptography in iOS, macOS, tvOS, watchOS, iTunes for Windows, iCloud for Windows

High 7.5 Published 3 Apr 2019 Updated 5 Aug 2024

Flawed prime number testing in Apple OSes and services could allow security bypass, requiring updates to iOS, macOS, and related software.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-4398?

CVE-2018-4398 is a high-severity vulnerability in Apple Icloud, published on 3 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue existed in the method for determining prime numbers. This issue was addressed by using pseudorandom bases for testing of primes. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1, iTunes 12.9.1, iCloud for Windows 7.8.

Weakness: CWE-20

Which versions are affected by CVE-2018-4398?

It affects 6 products.

Products include Apple Icloud, Apple Iphone Os, Apple Itunes, Apple Mac Os X, Apple Tvos, Apple Watchos.

How do I fix CVE-2018-4398?

No fix has been published for CVE-2018-4398 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-4398 being exploited?

There is no known exploitation of CVE-2018-4398 in the wild and no public exploit code.

All Apple Icloud vulnerabilities

Sources

Also known as GHSA-fpw7-ffc3-qq83.