PT-2017-19416 · Arm · Mbed Tls

Published 2017-01-29 · Updated 2017-01-29

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions mbedtls versions prior to 1.3.18

Description The issue concerns a non-default configuration option in mbedtls that could lead to session key recovery in very long TLS sessions. Additionally, there was a potential for stack corruption, although it cannot be triggered remotely. Several bugs have also been fixed.

Recommendations For versions prior to 1.3.18, update to version 1.3.18 to resolve the issue.

Related Identifiers

MGASA-2017-0030

Affected Products

Mbed Tls

References · 4

• https://advisories.mageia.org/MGASA-2017-0030.html · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0030 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=20162 · Note
• https://tls.mbed.org/tech-updates/releases/mbedtls-2.4.0-2.1.6-and-1.3.18-released · Note