Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
mbed tls vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv3
CVE-2024-23744
An issue exists in Mbed TLS 3.5.1. There is persistent handshake denial if a client sends a TLS 1.3 ClientHello without extensions.
Arm Mbed Tls
4.7
CVSSv3
CVE-2018-19608
Arm Mbed TLS prior to 2.14.1, prior to 2.7.8, and prior to 2.1.17 allows a local unprivileged malicious user to recover the plaintext of RSA decryption, which is used in RSA-without-(EC)DH(E) cipher suites.
Arm Mbed Tls
5.9
CVSSv3
CVE-2020-36477
An issue exists in Mbed TLS prior to 2.24.0. The verification of X.509 certificates when matching the expected common name (the cn argument of mbedtls_x509_crt_verify) with the actual certificate name is mishandled: when the subjecAltName extension is present, the expected name i...
Arm Mbed Tls
4.7
CVSSv3
CVE-2021-36647
Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions prior to 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information (typically an untrusted opera...
Arm Mbed Tls
1 Github repository
5.5
CVSSv3
CVE-2024-23170
An issue exists in Mbed TLS 2.x prior to 2.28.7 and 3.x prior to 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local malicious user to recover the plaintext. It requires the malicious user to send a large number of m...
Arm Mbed Tls
5.3
CVSSv3
CVE-2020-36421
An issue exists in Arm Mbed TLS prior to 2.23.0. Because of a side channel in modular exponentiation, an RSA private key used in a secure enclave could be disclosed.
Arm Mbed Tls
Debian Debian Linux 10.0
9.1
CVSSv3
CVE-2022-35409
An issue exists in Mbed TLS prior to 2.28.1 and 3.x prior to 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly...
Arm Mbed Tls
Debian Debian Linux 10.0
7.5
CVSSv3
CVE-2021-43666
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and previous versions in the mbedtls_pkcs12_derivation function when an input password's length is 0.
Arm Mbed Tls
Debian Debian Linux 10.0
5.3
CVSSv3
CVE-2020-36422
An issue exists in Arm Mbed TLS prior to 2.23.0. A side channel allows recovery of an ECC private key, related to mbedtls_ecp_check_pub_priv, mbedtls_pk_parse_key, mbedtls_pk_parse_keyfile, mbedtls_ecp_mul, and mbedtls_ecp_mul_restartable.
Arm Mbed Tls
Debian Debian Linux 10.0
7.5
CVSSv3
CVE-2020-36423
An issue exists in Arm Mbed TLS prior to 2.23.0. A remote attacker can recover plaintext because a certain Lucky 13 countermeasure doesn't properly consider the case of a hardware accelerator.
Arm Mbed Tls
Debian Debian Linux 10.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4040
privilege escalation
CVE-2024-4112
CVE-2024-32872
man-in-the-middle
CVE-2024-32788
bypass
CVE-2024-3400
CVE-2024-28976
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »