ARM mbed TLS 3.5.2

CPE Details

ARM mbed TLS 3.5.2
arm
mbed_tls
3.5.2
2024-02-03
00h39 +00:00
2024-02-03
00h39 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:arm:mbed_tls:3.5.2:*:*:*:*:*:*:*

Informations

Vendor

arm

Product

mbed_tls

Version

3.5.2

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2024-45157 2024-09-05 00h00 +00:00 An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not cause the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are disabled.
5.1
Moyen
CVE-2024-45159 2024-09-05 00h00 +00:00 An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certificate does not have appropriate values in if keyUsage or extKeyUsage extensions, then the return value of mbedtls_ssl_get_verify_result() would incorrectly have the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_KEY_USAGE bits clear. As a result, an attacker that had a certificate valid for uses other than TLS client authentication would nonetheless be able to use it for TLS client authentication. Only TLS 1.3 servers were affected, and only with optional authentication (with required authentication, the handshake would be aborted with a fatal alert).
9.8
Critique