Описание
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| mbedtls | fixed | 3.6.6-0.1 | package | |
| mbedtls | no-dsa | trixie | package | |
| mbedtls | not-affected | bookworm | package | |
| mbedtls | not-affected | bullseye | package |
Примечания
https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-sigalg-injection/
Introduced by: https://github.com/Mbed-TLS/mbedtls/commit/693a47ab1d076164baf0e5baff645b0e0d4d966b (mbedtls-3.3.0)
Fixed by: https://github.com/Mbed-TLS/mbedtls/commit/0165a8d7637a458f49cfe01be1f21aa0f91143d7 (mbedtls-3.6.6)
EPSS
Процентиль: 3%
0.00135
Низкий
Связанные уязвимости
CVSS3: 6.5
ubuntu
4 месяца назад
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
CVSS3: 6.5
redhat
4 месяца назад
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
CVSS3: 6.5
nvd
4 месяца назад
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
CVSS3: 6.5
github
4 месяца назад
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
EPSS
Процентиль: 3%
0.00135
Низкий