CVE-2017-2784

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2017-2784

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-2784.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-2784

Related

Published

2017-04-20T18:59:01Z

Modified

2024-12-05T15:02:24.190201Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.

References

Affected packages

Alpine:v3.10 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

Alpine:v3.11 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

Alpine:v3.12 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

Alpine:v3.13 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

Alpine:v3.14 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

Alpine:v3.15 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

Alpine:v3.16 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

Alpine:v3.17 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

Alpine:v3.18 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

Alpine:v3.19 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

Alpine:v3.20 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

Alpine:v3.21 / mbedtls

Package

Name: mbedtls
Purl: pkg:apk/alpine/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-r0

Affected versions

2.*

2.0.0-r0

2.1.2-r0

2.2.0-r0

2.2.0-r1

2.2.1-r0

2.3.0-r0

2.4.0-r0

2.4.1-r0

Debian:11 / mbedtls

Package

Name: mbedtls
Purl: pkg:deb/debian/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / mbedtls

Package

Name: mbedtls
Purl: pkg:deb/debian/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / mbedtls

Package

Name: mbedtls
Purl: pkg:deb/debian/mbedtls?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/mbed-tls/mbedtls

Affected ranges

Type: GIT
Repo: https://github.com/mbed-tls/mbedtls
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

016a0d3b6f23130a7f26c32afb5df08efcf19967

Last affected

0a0c22e0efcf2f8f71d7e16712f80b8f77326f72

Last affected

1a6a15c795922f05bd2ea17addf27eddcd256a15

Last affected

4cb87f409df0ddd878ea50cfca7dc8735ee574f2

Last affected

543e4366bc102d59623717b9053547d10605e725

Last affected

8cea8ad8b825b0bf5884054af7499f1d5c3ebeb4

Last affected

b998e27547f986427730f033f4d1bcd028ffd08f

Last affected

c1d54bb7b2a80d0f153fd92a13e1b901778f17d3

Last affected

c4e7d8a3817bbdee218328efa9e482217038152b

Last affected

ef43d41f671805406fd83cdf8ec5f54b1fa12c33

Affected versions

Other

beta-oob-2

list

mbedtls-1.*

mbedtls-1.3.10

mbedtls-1.3.11

mbedtls-1.3.12

mbedtls-1.3.13

mbedtls-1.3.14

mbedtls-1.3.15

mbedtls-1.3.16

mbedtls-1.3.17

mbedtls-1.3.18

mbedtls-1.4-dtls-preview

mbedtls-2.*

mbedtls-2.0.0

mbedtls-2.1.0

mbedtls-2.1.1

mbedtls-2.1.2

mbedtls-2.1.3

mbedtls-2.1.4

mbedtls-2.1.5

mbedtls-2.1.6

polarssl-1.*

polarssl-1.2.0

polarssl-1.2.1

polarssl-1.2.2

polarssl-1.2.3

polarssl-1.2.4

polarssl-1.2.5

polarssl-1.2.6

polarssl-1.3.0

polarssl-1.3.0-rc0

polarssl-1.3.1

polarssl-1.3.2

polarssl-1.3.3

polarssl-1.3.4

polarssl-1.3.5

polarssl-1.3.6

polarssl-1.3.7

polarssl-1.3.8

polarssl-1.3.9