CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-52353
https://notcve.org/view.php?id=CVE-2023-52353
21 Jan 2024 — An issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is mishandled. For example, if the last connection negotiated TLS 1.2, then 1.2 becomes the new maximum. Se descubrió un problema en Mbed TLS hasta la versión 3.5.1. En mbedtls_ssl_session_reset, la versión TLS máxima negociable no se maneja correctamente. • https://github.com/Mbed-TLS/mbedtls/issues/8654 • CWE-384: Session Fixation •
CVSS: 4.7EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36647
https://notcve.org/view.php?id=CVE-2021-36647
17 Jan 2023 — Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to recover the private keys used in RSA. • https://github.com/ARMmbed/mbedtls/releases • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2022-46392 – Gentoo Linux Security Advisory 202409-14
https://notcve.org/view.php?id=CVE-2022-46392
15 Dec 2022 — An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically, an untrusted operating system attacking a secure enclave) can recover an RSA private key after observing the victim performing a single private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for the exponentiation is 3 or smaller. Se descubrió un problema en Mbed TLS anterior a 2.28.2 y 3.x anterior a 3.3.0. Un adversario con acces... • https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2 • CWE-203: Observable Discrepancy •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-46393 – Gentoo Linux Security Advisory 202409-14
https://notcve.org/view.php?id=CVE-2022-46393
15 Dec 2022 — An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX. Se descubrió un problema en Mbed TLS anterior a 2.28.2 y 3.x anterior a 3.3.0. Existe un posible desbordamiento de búfer de almacenamiento dinámico y una sobrelectura de búfer de almacenamiento dinámico en DTLS si MBEDTLS_SSL_DTLS_CONNECTION... • https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 9.4EPSS: 0%CPEs: 3EXPL: 1CVE-2022-35409 – Gentoo Linux Security Advisory 202301-08
https://notcve.org/view.php?id=CVE-2022-35409
15 Jul 2022 — An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using... • https://github.com/Mbed-TLS/mbedtls/releases • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2021-43666 – Gentoo Linux Security Advisory 202301-08
https://notcve.org/view.php?id=CVE-2021-43666
24 Mar 2022 — A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0. Se presenta una vulnerabilidad de denegación de servicio en mbed TLS 3.0.0 y anteriores, en la función mbedtls_pkcs12_derivation cuando la longitud de una contraseña de entrada es 0 Multiple vulnerabilities have been discovered in Mbed TLS, the worst of which could result in arbitrary code execution. Versions less than 2.28.1 are affected. • https://github.com/ARMmbed/mbedtls/issues/5136 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-45451
https://notcve.org/view.php?id=CVE-2021-45451
21 Dec 2021 — In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application. En Mbed TLS versiones anteriores a 3.1.0, la función psa_aead_generate_nonce permite omitir la política o el descifrado basado en oráculos cuando el búfer de salida es encontrada en ubicaciones de memoria accesibles para una aplicación no confiable • https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 1CVE-2021-44732 – Gentoo Linux Security Advisory 202301-08
https://notcve.org/view.php?id=CVE-2021-44732
20 Dec 2021 — Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure. Mbed TLS versiones anteriores a 3.0.1,presenta una doble liberación en determinadas condiciones de salida de memoria, como es demostrado por un fallo de la función mbedtls_ssl_set_session() Multiple vulnerabilities have been discovered in Mbed TLS, the worst of which could result in arbitrary code execution. Versions less than 2.28.1 are affected. • https://bugs.gentoo.org/829660 • CWE-415: Double Free •
CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 0CVE-2020-36475 – Gentoo Linux Security Advisory 202301-08
https://notcve.org/view.php?id=CVE-2020-36475
23 Aug 2021 — An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). The calculations performed by mbedtls_mpi_exp_mod are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie-Hellman key pairs. Se ha detectado un problema en Mbed TLS versiones anteriores a 2.25.0 (y versiones anteriores a 2.16.9 LTS y versiones anteriores a 2.7.18 LTS). Los cálculos llevado a cabo por la función mbedtls_mpi_exp_mod no están limitados; por lo... • https://cert-portal.siemens.com/productcert/pdf/ssa-756638.pdf • CWE-131: Incorrect Calculation of Buffer Size •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2020-36476 – Gentoo Linux Security Advisory 202301-08
https://notcve.org/view.php?id=CVE-2020-36476
23 Aug 2021 — An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory. Se ha detectado un problema en Mbed TLS versiones anteriores a 2.24.0 (y versiones anteriores a 2.16.8 LTS y versiones anteriores a 2.7.17 LTS). Falta la puesta a cero de los búferes de texto plano en la función mbedtls_ssl_read para borrar de la memoria los datos no usados de la aplicación. Multip... • https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8 • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •