PT-2024-22563 · Mbed Tls+1 · Mbed Tls+1

Hey3E · Published 2024-04-02 · Updated 2025-06-10 · CVE-2024-28755

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 3.5.x through 3.5.x before 3.6.0 Mbed TLS versions prior to 3.6.0

Description An issue was discovered in Mbed TLS when an SSL context was reset with the mbedtls ssl session reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.

Recommendations For Mbed TLS versions prior to 3.6.0, update to version 3.6.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the mbedtls ssl session reset() API until a patch is available.

Fix

DoS

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2024-28755

Affected Products

Debian

Mbed Tls

References · 14

• https://osv.dev/vulnerability/CVE-2024-28755 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-28755 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28755 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28755 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-28755 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-28755 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28755 · Vendor Advisory
• https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0 · Note
• https://hey3e.github.io · Note
• https://twitter.com/CVEnew/status/1775352030254485526 · Twitter Post
• https://github.com/hey3e · Note
• https://t.me/cvenotify/125186 · Telegram Post
• https://t.me/cvenotify/75595 · Telegram Post