CVE-2024-28755

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-28755
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28755.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-28755
Downstream
Published
2024-04-03T03:15:10.140Z
Modified
2026-04-10T05:12:07.368733Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
[none]
Details

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtlssslsession_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.

References

Affected packages

Git / github.com/armmbed/mbedtls

Affected ranges

Type
GIT
Repo
https://github.com/armmbed/mbedtls
Events
Introduced
1ec69067fa1351427f904362c1221b31538c8b57
Last affected
2ca6c285a0dd3f33982dd57299012dacab1ff206
Database specific 
{
    "versions": [
        {
            "introduced": "3.5.0"
        },
        {
            "last_affected": "3.6.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/mbed-tls/mbedtls
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2ca6c285a0dd3f33982dd57299012dacab1ff206

Affected versions

Other
beta-oob-2
mbedos-release-15-11
mbedos-techcon-oob2
mbedtls-2.*
mbedtls-2.0.0
mbedtls-2.1.0
mbedtls-2.1.1
mbedtls-2.1.2
mbedtls-2.10.0
mbedtls-2.11.0
mbedtls-2.12.0
mbedtls-2.13.0
mbedtls-2.13.1
mbedtls-2.14.0
mbedtls-2.16.0
mbedtls-2.19.0
mbedtls-2.19.0d1
mbedtls-2.19.0d2
mbedtls-2.19.1
mbedtls-2.2.0
mbedtls-2.2.1
mbedtls-2.20.0
mbedtls-2.20.0d0
mbedtls-2.21.0
mbedtls-2.22.0d0
mbedtls-2.24.0
mbedtls-2.26.0
mbedtls-2.3.0
mbedtls-2.4.0
mbedtls-2.5.0
mbedtls-2.5.1
mbedtls-2.6.0
mbedtls-2.6.0-rc1
mbedtls-2.7.0
mbedtls-2.7.0-rc1
mbedtls-2.8.0
mbedtls-2.8.0-rc1
mbedtls-2.9.0
polarssl-1.*
polarssl-1.2.0
polarssl-1.2.1
polarssl-1.2.2
polarssl-1.2.4
polarssl-1.2.5
polarssl-1.2.6
polarssl-1.3.0
polarssl-1.3.0-rc0
polarssl-1.3.1
polarssl-1.3.2
polarssl-1.3.3
polarssl-1.3.4
polarssl-1.3.5
polarssl-1.3.6
polarssl-1.3.7
polarssl-1.3.8
polarssl-1.3.9
v2.*
v2.24.0
v2.26.0
yotta-2.*
yotta-2.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28755.json"