PT-2023-5882 · Mbed Tls+3 · Mbed Tls+3

Published 2023-10-05 · Updated 2025-08-21 · CVE-2023-43615

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 2.x before 2.28.5 Mbed TLS versions 3.x before 3.5.0

Description The issue is related to errors in handling encryption in (D)TLS connections, specifically when using zero encryption or RC4 cipher. This can allow a remote attacker to execute arbitrary code. The issue is a buffer overflow.

Recommendations For Mbed TLS versions 2.x before 2.28.5, update to version 2.28.5 or later. For Mbed TLS versions 3.x before 3.5.0, update to version 3.5.0 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

CWE-119

Related Identifiers

ALT-PU-2024-15509

ALT-PU-2025-10462

BDU:2023-06575

CVE-2023-43615

Affected Products

Alt Linux

Debian

Mbed Tls

Red Os

References · 73

• https://errata.altlinux.org/ALT-PU-2024-15509 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06575 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24119 · Security Note
• https://bdu.fstec.ru/vul/2022-02236 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36476 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45157 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52353 · Security Note
• https://bdu.fstec.ru/vul/2023-06434 · Security Note
• https://bdu.fstec.ru/vul/2022-01649 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45450 · Security Note
• https://errata.altlinux.org/ALT-PU-2025-10462 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7SB7L6A56QZALDTOZ6O4X7PTC4I647R · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02039 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36424 · Security Note
• https://security-tracker.debian.org/tracker/source-package/mbedtls · Vendor Advisory