CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48981
https://notcve.org/view.php?id=CVE-2024-48981
20 Nov 2024 — An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet header by looking up the identifying first byte and matching it against a table of possible lengths. The initial parsing function, hciTrSerialRxIncoming does not drop packets with invalid identifiers but also does not set a safe default for the length of unknown packets' headers, leading to a buffer overflow. This can be leveraged into an arbitrary write by an attacker. I... • https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/source/cordio/stack_adaptation/hci_tr.c#L161 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48983
https://notcve.org/view.php?id=CVE-2024-48983
20 Nov 2024 — An issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software dynamically determines the length of the packet data by reading 2 bytes from the packet header. A buffer is then allocated to contain the entire packet, the size of which is calculated as the length of the packet body determined earlier plus the header length. WsfMsgAlloc then increments this again by sizeof(wsfMsg_t). This may cause an integer overflow that results in the buffer being significantly too small to contai... • https://github.com/mbed-ce/mbed-os/blob/54e8693ef4ff7e025018094f290a1d5cf380941f/connectivity/FEATURE_BLE/libraries/cordio_stack/wsf/sources/port/baremetal/wsf_msg.c#L72 • CWE-190: Integer Overflow or Wraparound •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45159
https://notcve.org/view.php?id=CVE-2024-45159
05 Sep 2024 — An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certificate does not have appropriate values in if keyUsage or extKeyUsage extensions, then the return value of mbedtls_ssl_get_verify_result() would incorrectly have the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_KEY_USAGE bits clear. As a result, an attacker that had a certificate valid for uses other than TLS client authentication would nonet... • https://mbed-tls.readthedocs.io/en/latest/security-advisories • CWE-295: Improper Certificate Validation •
CVSS: 5.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45157
https://notcve.org/view.php?id=CVE-2024-45157
05 Sep 2024 — An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not cause the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are disabled. • https://mbed-tls.readthedocs.io/en/latest/security-advisories • CWE-696: Incorrect Behavior Order •
CVSS: 9.0EPSS: 1%CPEs: 1EXPL: 0CVE-2024-22905
https://notcve.org/view.php?id=CVE-2024-22905
19 Apr 2024 — Buffer Overflow vulnerability in ARM mbed-os v.6.17.0 allows a remote attacker to execute arbitrary code via a crafted script to the hciTrSerialRxIncoming function. Vulnerabilidad de desbordamiento de búfer en ARM mbed-os v.6.17.0 permite a un atacante remoto ejecutar código arbitrario a través de un script manipulado para la función hciTrSerialRxIncoming. • https://github.com/ARMmbed/mbed-os/blob/7c7d20da6527885237094d9d50ce099404414201/connectivity/FEATURE_BLE/source/cordio/stack_adaptation/hci_tr.c#L125 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-28755
https://notcve.org/view.php?id=CVE-2024-28755
03 Apr 2024 — An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2. Se descubrió un problema en Mbed TLS 3.5.x anterior a 3.6.0. Cuando se restableció un contexto SSL con la API mb... • https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0 • CWE-326: Inadequate Encryption Strength •
CVSS: 9.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-30166
https://notcve.org/view.php?id=CVE-2024-30166
03 Apr 2024 — In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read (of less than 256 bytes) in a TLS 1.3 server via a TLS 3.1 ClientHello. En Mbed TLS 3.3.0 hasta 3.5.2 anterior a 3.6.0, un cliente malintencionado puede provocar la divulgación de información o una denegación de servicio debido a una sobrelectura del búfer de pila (de menos de 256 bytes) en un servidor TLS 1.3 a través de un TLS. 3.1 ClientHello. • https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0 • CWE-121: Stack-based Buffer Overflow •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28836
https://notcve.org/view.php?id=CVE-2024-28836
03 Apr 2024 — An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of the protocol if it is disabled. If the TLS 1.2 implementation was disabled at build time, a TLS 1.2 client could put a TLS 1.3-only server into an infinite loop processing a TLS 1.2 ClientHello, resulting in a denial of service. If the TLS 1.2 implementation was disabled at runtime, a TLS 1.2 client can successfully establish a TLS 1.2 connection with... • https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23170 – Gentoo Linux Security Advisory 202409-14
https://notcve.org/view.php?id=CVE-2024-23170
31 Jan 2024 — An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario. Se descubrió un problema en Mbed TLS 2.x anterior a 2.28.7 y 3.x anterior a 3.5.2. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5 • CWE-203: Observable Discrepancy CWE-385: Covert Timing Channel •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23775 – Gentoo Linux Security Advisory 202409-14
https://notcve.org/view.php?id=CVE-2024-23775
31 Jan 2024 — Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension(). Vulnerabilidad de desbordamiento de enteros en Mbed TLS 2.x anterior a 2.28.7 y 3.x anterior a 3.5.2 permite a los atacantes provocar una denegación de servicio (DoS) a través de mbedtls_x509_set_extension(). Multiple vulnerabilities have been discovered in Mbed TLS, the worst of which could lead to information disclosure or denial of servic... • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GP5UU7Z6LJNBLBT4SC5WWS2HDNMTFZH5 • CWE-190: Integer Overflow or Wraparound •