Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption, which is used in RSA-without-(EC)DH(E) cipher suites.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to     recover the plaintext of RSA decryption, which is used in RSA-without-(EC)DH(E) cipher suites.
    (CVE-2018-19608)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to
    recover the plaintext of RSA decryption, which is used in RSA-without-(EC)DH(E) cipher suites.
    (CVE-2018-19608)

- Update to 2.14.1

  - CVE-2018-19608 (#1656784)

Release notes:
https://tls.mbed.org/tech-updates/releases/mbedtls-2.14.1-2.7.8-and-2.
1.17-released

Security Advisory:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security
-advisory-2018-03

----

  - Update to 2.14.0

Release notes:
https://tls.mbed.org/tech-updates/releases/mbedtls-2.14.0-2.7.7-and-2.
1.16-released

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Janos Follath reports :

An attacker who can run code on the same machine that is performing an RSA decryption can potentially recover the plaintext through a Bleichenbacher-like oracle.

ID	Name	Product	Family	Severity
245472	Linux Distros Unpatched Vulnerability : CVE-2018-19608	Nessus	Misc.	medium
426620	Alpine: multiple mbedtls2 packages: security update to 2.14.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
426620	Alpine: multiple mbedtls2 packages: security update to 2.14.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
424136	Alpine: multiple mbedtls packages: security update to 2.14.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
424136	Alpine: multiple mbedtls packages: security update to 2.14.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
120439	Fedora 29 : mbedtls (2018-571ea64f3d)	Nessus	Fedora Local Security Checks	medium
120281	Fedora 28 : mbedtls (2018-1f6ca69276)	Nessus	Fedora Local Security Checks	medium
119698	FreeBSD : Mbed TLS -- Local timing attack on RSA decryption (293f40a0-ffa1-11e8-b258-0011d823eebd)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2018-19608

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium