PT-2017-19416 · Arm · Mbed Tls

Publicado 2017-01-29 · Atualizado 2017-01-29

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions mbedtls versions prior to 1.3.18

Description The issue concerns a non-default configuration option in mbedtls that could lead to session key recovery in very long TLS sessions. Additionally, there was a potential for stack corruption, although it cannot be triggered remotely. Several bugs have also been fixed.

Recommendations For versions prior to 1.3.18, update to version 1.3.18 to resolve the issue.

Identificadores relacionados

MGASA-2017-0030

Produtos afetados

Mbed Tls

Referências · 4

• https://advisories.mageia.org/MGASA-2017-0030.html · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2017-0030 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=20162 · Nota
• https://tls.mbed.org/tech-updates/releases/mbedtls-2.4.0-2.1.6-and-1.3.18-released · Nota