Lucene search

[email protected]CVE-2018-4086

HistoryApr 03, 2018 - 6:29 a.m.

CVE-2018-4086

2018-04-0306:29:00

CWE-295

[email protected]

web.nvd.nist.gov

apple

ios

macos

tvos

watchos

security

cve-2018-4086

certificate validation

remote attack

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

7.5 High

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.009 Low

EPSS

Percentile

82.7%

JSON

An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the “Security” component. It allows remote attackers to spoof certificate validation via crafted name constraints.

CPENameOperatorVersion
apple:iphone_osapple iphone oslt11.2.5
apple:mac_os_xapple mac os xlt10.13.3
apple:apple_tvapple apple tvlt11.2.5
apple:watchosapple watchoslt4.2.2

CPE	Name	Operator	Version
apple:iphone_os	apple iphone os	lt	11.2.5
apple:mac_os_x	apple mac os x	lt	10.13.3
apple:apple_tv	apple apple tv	lt	11.2.5
apple:watchos	apple watchos	lt	4.2.2

References

www.securityfocus.com/bid/102782

www.securitytracker.com/id/1040265

www.securitytracker.com/id/1040267

support.apple.com/HT208462

support.apple.com/HT208463

support.apple.com/HT208464

support.apple.com/HT208465

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

7.5 High

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.009 Low

EPSS

Percentile

82.7%

JSON

Related for CVE-2018-4086

prion1 openvas1 nessus2 apple8