CVE-2018-0487

Name: CVE-2018-0487
Creator: NVD / NIST
Published: 2018-02-13T15:29:00.217+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 3.32%

Last modified Jun 17, 2026

CVE-2018-0487 is a vulnerability of currently unknown severity. ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session.. EPSS estimates a 3.32% chance of exploitation in the next 30 days.

Description

ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session.

Metrics

EPSS Probability

3.32%

87.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-119

Affected Software

Vendor	Product	Versions
Arm	Mbed Tls	>= 1.3.8, < 1.3.22
Arm	Mbed Tls	>= 2.1.0, < 2.1.10
Arm	Mbed Tls	>= 2.2.0, < 2.7.0
Debian	Debian Linux	8.0
Debian	Debian Linux	9.0

References

http://www.securityfocus.com/bid/103056Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201804-19Third Party Advisory
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01Mitigation, Vendor Advisory
https://usn.ubuntu.com/4267-1/
https://www.debian.org/security/2018/dsa-4138Third Party Advisory
https://www.debian.org/security/2018/dsa-4147Third Party Advisory
http://www.securityfocus.com/bid/103056Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201804-19Third Party Advisory
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01Mitigation, Vendor Advisory
https://usn.ubuntu.com/4267-1/
https://www.debian.org/security/2018/dsa-4138Third Party Advisory
https://www.debian.org/security/2018/dsa-4147Third Party Advisory

Timeline

Published: Feb 13, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-0487?

How severe is CVE-2018-0487?

Severity scoring for CVE-2018-0487 is pending analysis. The EPSS model estimates a 3.32% probability of exploitation in the next 30 days.

How do I fix CVE-2018-0487?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-0487?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST