PT-2025-48511 · Julia · Mbedtls Jll

Publicado 2025-11-21 · Atualizado 2025-11-21

OSV

An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid.

Identificadores relacionados

JLSEC-2025-213

Produtos afetados

Mbedtls Jll

Referências · 8

• https://github.com/ARMmbed/mbedtls/releases/tag/v2.7.18 · Nota
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.9 · Nota
• https://github.com/ARMmbed/mbedtls/issues/3629 · Nota
• https://github.com/ARMmbed/mbedtls/releases/tag/v2.25.0 · Nota
• https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html · Nota
• https://osv.dev/vulnerability/JLSEC-2025-213 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-756638.pdf · Nota