CVE-2024-28960

Опубликовано: 29 мар. 2024

Источник: nvd

CVSS3: 8.2

EPSS Низкий

Описание

An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory.

Ссылки

https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2024-03.md
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YE3QRREGJC6K34JD4LZ5P3IALNX4QYY/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6UZNBMKYEV2J5DI7R4BQGL472V7X3WJY/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NCDU52ZDA7TX3HC5JCU6ZZIJQOPTNBK6/
Mailing List
Third Party Advisory
https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/
Vendor Advisory
https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2024-03.md
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YE3QRREGJC6K34JD4LZ5P3IALNX4QYY/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6UZNBMKYEV2J5DI7R4BQGL472V7X3WJY/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NCDU52ZDA7TX3HC5JCU6ZZIJQOPTNBK6/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5YE3QRREGJC6K34JD4LZ5P3IALNX4QYY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6UZNBMKYEV2J5DI7R4BQGL472V7X3WJY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NCDU52ZDA7TX3HC5JCU6ZZIJQOPTNBK6/
https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:arm:mbed_crypto:*:*:*:*:*:*:*:*

Версия до 3.1.0 (включая)

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*

Версия от 2.1.8 (включая) до 2.28.8 (исключая)

cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.6.0 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

EPSS

Процентиль: 40%

0.0018

Низкий

8.2 High

CVSS3

Дефекты

CWE-284

Связанные уязвимости

CVE-2024-28960

CVSS3: 8.2

ubuntu

больше 1 года назад

An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory.

CVE-2024-28960

CVSS3: 5.3

redhat

больше 1 года назад

An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory.

CVE-2024-28960

CVSS3: 8.2

msrc

около 1 года назад

Описание отсутствует

CVE-2024-28960

CVSS3: 8.2

debian

больше 1 года назад

An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28. ...

GHSA-6h48-8w2f-5w94

CVSS3: 8.2

github

больше 1 года назад

An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory.

EPSS

Процентиль: 40%

0.0018

Низкий

8.2 High

CVSS3

Дефекты

CWE-284