Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2018-4105: macOS before 10.13.4 may truncate APFS volume passwords
CVE-2018-4105 · published 8 years ago
Summary
Versions of macOS earlier than 10.13.4 that use the APFS file system can have the password for an encrypted volume unintentionally shortened by a malicious actor. This makes the password easier to guess and could give an attacker access to the data on that volume. Update macOS to version 10.13.4 or later to resolve the issue.
What to do
- Update apple mac_os_x to version 10.13.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apple | mac_os_x |
< 10.13.4 cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "APFS" component. It allows attackers to trigger truncation of an APFS volume password vi...
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "APFS" component. It allows attackers to trigger truncation of an APFS volume password via an unspecified injection.
References
- http://www.securityfocus.com/bid/103582 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1040608 Third Party Advisory VDB Entry
- https://support.apple.com/HT208692 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-20Improper Input Validation
Timeline
Published3 Apr 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-4105 · NVD
Track software like this
Free during beta