PT-2024-41045 · Mbed Tls · Mbed Tls

Published 2024-02-14 · Updated 2024-02-14

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions mbedtls versions 2.28.3 through 2.28.6

Description The issue concerns a buffer overread in TLS stream cipher suites, a timing side channel in private key RSA operations, and a buffer overflow in mbedtls x509 set extension.

Recommendations For mbedtls versions 2.28.3 through 2.28.6, update to version 2.28.7 to fix the security vulnerabilities.

Related Identifiers

MGASA-2024-0037

Affected Products

Mbed Tls

References · 11

• https://advisories.mageia.org/MGASA-2024-0037.html · Security Note
• https://osv.dev/vulnerability/MGASA-2024-0037 · Vendor Advisory
• https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.5 · Note
• https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.7 · Note
• https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.4 · Note
• https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.5 · Note
• https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.6 · Note
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2 · Note
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2023-10-1 · Note
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1 · Note
• https://bugs.mageia.org/show_bug.cgi?id=32844 · Note