PT-2024-6380 · Mbed Tls+3 · Mbed Tls+3

Published 2024-09-03 · Updated 2025-04-09 · CVE-2024-45157

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 2.28.9 Mbed TLS versions 3.x prior to 3.6.1

Description The issue is related to the misuse of a cryptographic algorithm in Mbed TLS, where the user-selected algorithm is not used. Specifically, enabling MBEDTLS PSA HMAC DRBG MD TYPE does not cause the PSA subsystem to use HMAC DRBG, unless MBEDTLS PSA CRYPTO EXTERNAL RNG and MBEDTLS CTR DRBG C are disabled. This could potentially allow an attacker to expose protected information.

Recommendations For Mbed TLS versions prior to 2.28.9, update to version 2.28.9 or later to resolve the issue. For Mbed TLS versions 3.x prior to 3.6.1, update to version 3.6.1 or later to resolve the issue. As a temporary workaround, consider disabling the use of the PSA subsystem until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-696

Related Identifiers

ALT-PU-2024-15509

ALT-PU-2025-4727

BDU:2024-07428

CVE-2024-45157

OPENSUSE-SU-2024:14304-1

Affected Products

Alt Linux

Debian

Mbed Tls

Red Os

References · 24

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-45157 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-45157 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45157 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-45157 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-45157 · Vendor Advisory
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-08-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07428 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14304-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2024-45157 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45157 · Vendor Advisory
• https://github.com/rancher/rancher · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-mbedtls-cve-2024-45157 · Note
• https://t.me/cvenotify/94372 · Telegram Post