An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade mbedtls | Jul 30, 2024 | Dec 15, 2022 |
| Gentoo Linux | — | Upgrade net-libs/mbedtls. | Sep 23, 2024 | Dec 15, 2022 |
| Suse | — | Upgrade libmbedcrypto7-32bitUpgrade libmbedx509-1-64bitUpgrade libmbedcrypto7Upgrade libmbedx509-1-32bitUpgrade libmbedx509-1Upgrade libmbedtls14-64bitUpgrade mbedtls-develUpgrade libmbedcrypto7-64bitUpgrade libmbedtls14-32bitUpgrade libmbedtls14 | Jan 4, 2023 | Dec 15, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub