PT-2025-48506 · Julia · Mbedtls Jll

Publicado 2025-11-21 · Atualizado 2025-11-21

OSV

An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly uses a revocationDate check when deciding whether to honor certificate revocation via a CRL. In some situations, an attacker can exploit this by changing the local clock.

Identificadores relacionados

JLSEC-2025-208

Produtos afetados

Mbedtls Jll

Referências · 8

• https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.17 · Nota
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.24.0 · Nota
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.8 · Nota
• https://github.com/ARMmbed/mbedtls/issues/3340 · Nota
• https://github.com/ARMmbed/mbedtls/pull/3433 · Nota
• https://osv.dev/vulnerability/JLSEC-2025-208 · Aviso do Fabricante
• https://bugs.gentoo.org/740108 · Nota
• https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html · Nota