CVE-2021-44732

Опубликовано: 20 дек. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

Ссылки

https://bugs.gentoo.org/829660
Issue Tracking
Mailing List
Third Party Advisory
https://github.com/ARMmbed/mbedtls/releases
Release Notes
https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.12
Release Notes
https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0
Release Notes
https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0
Release Notes
https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
Mailing List
Third Party Advisory
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12
Exploit
Mitigation
Third Party Advisory
https://bugs.gentoo.org/829660
Issue Tracking
Mailing List
Third Party Advisory
https://github.com/ARMmbed/mbedtls/releases
Release Notes
https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.12
Release Notes
https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0
Release Notes
https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0
Release Notes
https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/06/msg00034.html
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12
Exploit
Mitigation
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*

Версия до 2.16.12 (исключая)

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*

Версия от 2.17.0 (включая) до 2.28.0 (исключая)

cpe:2.3:a:arm:mbed_tls:3.0.0:-:*:*:*:*:*:*

cpe:2.3:a:arm:mbed_tls:3.0.0:preview1:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 76%

0.00934

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-415

Связанные уязвимости

CVE-2021-44732

CVSS3: 9.8

ubuntu

около 4 лет назад

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

CVE-2021-44732

msrc

5 месяцев назад

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

CVE-2021-44732

CVSS3: 9.8

debian

около 4 лет назад

Mbed TLS before 3.0.1 has a double free in certain out-of-memory condi ...

GHSA-7g56-f7p4-fmcq

CVSS3: 9.8

github

около 4 лет назад

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.

BDU:2022-00710

CVSS3: 9.8

fstec

около 4 лет назад

Уязвимость функции mbedtls_ssl_set_session() реализация протоколов TLS и SSL Mbed TLS, связанная с ошибкой повторного освобождения памяти, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 76%

0.00934

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-415