Trustedfirmware: >> Mbed Tls >> 3.4.0 Security Vulnerabilities
An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
CVSS Score
5.5
EPSS Score
0.003
Published
2024-01-31
Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via mbedtls_x509_set_extension().
CVSS Score
7.5
EPSS Score
0.011
Published
2024-01-31
Mbed TLS 2.x before 2.28.5 and 3.x before 3.5.0 has a Buffer Overflow.
CVSS Score
7.5
EPSS Score
0.008
Published
2023-10-07
Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution.
CVSS Score
9.8
EPSS Score
0.011
Published
2023-10-07
Page 2